Questions tagged [cissp]

CISSP is an abreviation for Certified Information Systems Security Professional. It is a certification offered by the International Information Systems Security Certification Consortium, AKA: (ISC)^2.

Filter by
Sorted by
Tagged with
0
votes
1answer
80 views

What is the difference between concealment and secrecy in context of confidentiality?

I just started studying up for the CISSP and am having trouble understanding few concepts. This is regarding confidentiality, Below are some of the aspects of confidentiality Sensitivity Discretion ...
3
votes
3answers
486 views

How is a pepper used with salted passwords?

How is a pepper (a large constant number) used after a password has been salted with a salt by a hashing function such as bcrypt? From Sybex CISSP Official Study Guide, 8th Edition (2018): Adding ...
0
votes
1answer
43 views

security related certificate [closed]

I work in cyber security r&d for several years. Meanwhile, I have obtained a CEH (Certified Ethical Hacker) certificate and a CISSP certificate. I wish to move to security industry instead of r&...
0
votes
1answer
1k views

Difference between ISO/IEC 27001 and CISSP CBK

Sorry to ask this, I am quite new to Security area. Recently I am trying to introduce some security standards. After some searching I found this out in this doc Among them, ISO is the best-known ...
1
vote
0answers
252 views

What are the similarities and differences between CISSP CBK, ISO/IEC, and the NIST NICE Framework? [closed]

There are a ton of different information security/cyber security frameworks but I was wondering if someone can give a quick rundown of some major similarities and differences. It'll really help me ...
2
votes
2answers
1k views

What's the difference between “access aggregation” and “authorization creep”?

I'm studying for the CISSP and am getting hung up on some terminology. Specifically, I'm confused on the difference between access aggregation and authorization creep. In both cases, it seems to me ...
1
vote
2answers
1k views

What's a practical example of a Trusted Computing Base?

I'm studying for the CISSP exam and trying to wrap my mind around the concept of a Trusted Computing Base. Can someone provide a practical example? The recurring definition I see is that it's a "...
0
votes
2answers
1k views

How exactly are registration authorities related to certificate authorities?

In preparing for the CISSP exam, the course material seems to emphasize a distinct role between a Certificate Authority and a Registration Authority. As per the study guide description: ...
0
votes
1answer
212 views

Clarification on “data hiding” and how it applies to hardware?

I'm studying for the CISSP exam and one of the practice questions in my study guide has me a bit confused. The question is: Which of the following is NOT considered an example of data hiding? A. ...
1
vote
0answers
125 views

What's a practical example of “declassification”?

I'm studying for the CISSP exam and trying to wrap my mind around the term "declassification". Can someone provide a practical example? I get that declassification is necessary once "an asset no ...
0
votes
2answers
80 views

Terminology: What's the appropriate term for the digest output of various integrity hash and HMAC functions?

I've heard conflicting statements from various CISSP instructors, so I'd like some "real world" perspective: What is the appropriate terminology for the digest output of the following algorithms: ...
1
vote
3answers
12k views

What's the difference between “Due Care” and “Due Diligence”?

Can someone please explain the difference between "due care" and "due diligence"? They seem very similar to one another and after researching more and more, I'm getting confused. One tech book ...
-1
votes
2answers
322 views

What is the ideal and realistic(affordable) career path to a Cyber Security expert? [closed]

I'm a graduating university student taking up BS Computer Science with a specialization in Network Engineering, so I'm currently immersed in CCNA and am about to take the cert exam this month. I've ...
1
vote
1answer
229 views

The benefits of CISSP Training for a Java developer [closed]

I am currently a Java developer and content with what I make. My company currently offers a 7 Day CISSP training and I am not sure, whether to take this training. What benefits can I benefit by ...
2
votes
1answer
165 views

Administrative recovery control mentions antivirus - error?

I am reading through Version 7 of the CISSP study guide and stumbled on a possible error. It mentions - in the administrative controls section - that Recovery is a subset/alternate version of ...
0
votes
1answer
56 views

Why don't terminal IDs prevent unauthorized entery?

I'm studying for CISSP and had gotten this question wrong. I also found it and the correct answer online, but still don't understand the reasoning. Source Which of the following controls is not ...
3
votes
4answers
10k views

difference between need to know, least privilege and confidential

I'm studying for CISSP. Is least privilege, need to know and confidentiality all the same thing? In my book it says "confidentiality is sometimes referred to as the principle of least privilege" and ...
7
votes
1answer
2k views

What is collusion and how does seperation of duties prevent it, or fail to prevent it?

I'm studying for CISSP and came across the term "collusion". I understand it means when people work together to steal something, but don't quite get it. For example, if two gunmen rob a bank would ...
0
votes
2answers
163 views

Confusing definitions of “parasitic virus” and “worm”

I was studying for CISSP certification when I came across the question "what type of virus attaches itself to an executable?" The answer was "parasitic". I find terms relating to viruses and malware ...
55
votes
9answers
7k views

Why would security cover things like natural disasters?

I'm taking a course which is designed with the CISSP certification in mind. Though the class is categorized as software engineering, we talked a lot about physical security and, in particular, floods, ...
2
votes
1answer
495 views

CISSP Cert: can an IT sales pro pursue CISSP? [closed]

I am a sales and product professional who has a total of 9 years experience in IT; related to selling products indirectly or directly. I started my career working as a product manager for hardware ...
0
votes
1answer
633 views

Is there a great cheap or free site for the CISSP exam? [closed]

CCCure is not free and many others that are recommended on the site are not free....any suggestions?
2
votes
2answers
620 views

Smart cards and firewalls are what type of access control?

Specifically for the CISSP, trying to figure out what type of access control these would be considered.
3
votes
3answers
757 views

Vulnerability or Threat?

I have a practice question here: A business is going to determine the dangers to which it is exposed. What do we call a possible event that can have a disruptive effect on the reliability of ...
0
votes
2answers
1k views

Is there a “classic” information security textbook? [closed]

Much in the same way compilers has the dragon book, algorithms has the Cormen, and graphics has Foley & van Dam I am wondering what the book on computer security is. Not the "best" book, or the ...
6
votes
3answers
1k views

Is SESAME really used in Europe?

I am looking at a text that mentions that the Secure European System for Applications in a Multi-vendor Environment (SESAME) was designed to address some of Kerberos weakness, with enhancements such ...
1
vote
0answers
44 views

Does analyst API Flurry break Australian Privacy Act or any other Legal, Regulations, Compliance?

I want introduce Flurry API in my iOS app. But I heard since 2014 Australia start an act to against web page and mobile app to collect user information. My question is simple: Does using of API ...
0
votes
2answers
2k views

Is CISSP suitable for a Java architect? [closed]

I am a tech lead developing web (Java/JEE) and mobile applications (Android) for the past 12 years (mobile in last year though). I am somehow interested in IT security. Is it worth taking CISSP or ...
3
votes
0answers
122 views

Suggested books to study for CISSP? [duplicate]

Possible Duplicate: Good (preferably free) resource for CISSP practice questions I intend to study to take the CISSP exam within the next few months. Could anyone who's taken the CISSP please ...
2
votes
1answer
690 views

CISSP Certification [duplicate]

Possible Duplicate: Good (preferably free) resource for CISSP practice questions I am currently reviewing and aiming for a CISSP certification on the fourth quarter of this year. I've been ...
4
votes
6answers
3k views

Information Security Career tracks - Academically vs. IT certifications

I will try to be as straightforward as possible here. I am currently working as a security integrator at an integration company. I work with products of vendors like Check Point, Cisco, Juniper, HP, ...
2
votes
2answers
559 views

Legal Risk to unpatched servers

Since one of the 10 domains on the CISSP is legal/governance, I figured this would be the best place to ask. I recently did a security assessment for a non-profit. I found that their systems needed ...
1
vote
0answers
361 views

Best way to get “into the security industry”? [duplicate]

Possible Duplicate: What are the career paths in the computer security field? I've been called a "jack of all trades" guy, who has been working in health care and finance for about seven years. ...
3
votes
3answers
790 views

How do I clearly distinguish between groups of formal and informal models?

I'm currently studying for the CISSP exam and would like to ensure that I'm using proper terminology when referring to models. I'm a little confused because I'm coming across generic and specific ...
8
votes
1answer
1k views

What is a practical example of an action that violates the non-interference model?

I'm studying the non-interference model as part of CISSP prep and am having trouble thinking of a practical example where a violation would be involved (and the consequences of those violations). I ...
4
votes
2answers
195 views

Is it correct to consider audits as exclusively “detective” in nature?

I'm studying for the CISSP exam and one of the video lecture points didn't quite make sense to me. The instructor was discussing access control administration areas and began categorizing certain ...
5
votes
1answer
2k views

Is it correct to consider Task Based Access Control as a type of RBAC?

I'm studying for CISSP certification and one of the video lectures I viewed (CBT Nuggets) really confused me. Here are some excerpts from the lecture: "Role Based Access Control doesn't always ...
8
votes
3answers
6k views

Why does the ★-property rule of the Bell-LaPadula Model allow information to be stored in objects with HIGHER sensitivity labels?

I'm self-studying for the CISSP exam and am having difficulty wrapping my mind around the practical side of the ★-property rule in the Bell-LaPadula Model. I understand the mechanics of it and that ...
18
votes
7answers
21k views

How useful is CISSP to a recent graduate?

I am a recent graduate and would like to move into the IT Security field. My degree was just straight CS with no particular security focus. I have recently acquired a copy of a CISSP study guide and ...
24
votes
9answers
26k views

Good (preferably free) resource for CISSP practice questions

I'm looking to sit for my exam in a few weeks, and I want to have a good set of practice tests to bounce against and make sure that I'm up to par with the types of questions that will be asked.