by Shon Harris | Publisher: Pearson IT Certification | Release Date: May 2009 | ISBN: 9780789740106

The fast, powerful way to prepare for your CISSP exam!30+ hours of personal video training from leading security expert Shon HarrisAchieving the (ISC)2's globally recognized CISSP can give your IT career a lift. In this DVD, the world's #1 CISSP trainer brings her legendary five-day boot camp to your computer screen. Packed with over 30 hours of instruction adapted from Shon's classes, this video course includes realistic labs, scenarios, case studies, and animations designed to build and test your knowledge in real-word settings. Preparing for the CISSP has never been this easy or convenient.Master the skills and concepts you need for all ten CISSP common body of knowledge domains:Access ControlApplication SecurityBusiness Continuity and Disaster Recovery PlanningCryptographyInformation Security and Risk ManagementLegal, Regulations, Compliance, and InvestigationsOperations SecurityPhysical (Environmental) SecuritySecurity Architecture and DesignTelecommunications and Network SecuritySystem RequirementsOPERATING SYSTEM: Windows 2000, XP, or Vista; Mac OS X 10.4 (Tiger) or later MULTIMEDIA: DVD drive; 1024 x 768 or higher display; sound card with speakers COMPUTER: 500MHz or higher CPU; 128MB RAM or more

1. None
   • Introduction 00:07:24
   • Introduction 00:01:32
2. Domain 1 — Information Security and Risk Management
   • Information Security and Risk Management 00:01:32
   • Mainframe Days 00:03:17
   • Today’s Environment 00:01:36
   • Security Definitions 00:02:01
   • Examples of Some Vulnerabilities that Are Not Always Obvious 00:02:10
   • Risk — What Does It Really Mean? 00:02:10
   • Relationships 00:02:02
   • Who Deals with Risk? 00:03:32
   • AIC Triad 00:03:33
   • Who Is Watching? 00:02:05
   • Social Engineering 00:04:06
   • What Security People Are Really Thinking 00:01:14
   • Security Concepts 00:01:00
   • Security? 00:04:57
   • The Bad Guys Are Motivated 00:02:38
   • Open Standards 00:01:56
   • Without Standards 00:01:04
   • Controls 00:04:42
   • Holistic Security 00:03:38
   • Different Types of Law 00:03:22
   • How Is Liability Determined? 00:01:22
   • Due Diligence and Due Care 00:02:01
   • Prudent Person Rule 00:05:14
   • Risk Management 00:06:34
   • Planning Stage — Scope 00:02:04
   • Planning Stage — Analysis Method 00:01:01
   • Risk Management Tools 00:01:50
   • Defining Acceptable Levels 00:02:24
   • Acceptable Risk Level 00:00:52
   • Collecting and Analyzing Data Methods 00:01:04
   • What Is a Company Asset? 00:00:48
   • Data Collection — Identify Assets 00:01:01
   • Data Collection — Assigning Values 00:01:34
   • Asset Value 00:01:03
   • Data Collection — Identify Threats 00:01:20
   • Data Collection — Calculate Risks 00:01:38
   • Scenario Based — Qualitative 00:00:43
   • Risk Approach 00:00:40
   • Qualitative Analysis Steps 00:00:56
   • Want Real Answers? 00:00:53
   • Qualitative Risk Analysis 00:03:17
   • ARO Values 00:07:46
   • Can a Purely Quantitative Analysis Be Accomplished? 00:01:25
   • Risk Types 00:00:39
   • Losses 00:01:25
   • Cost/Benefit Analysis 00:00:58
   • Cost of a Countermeasure 00:01:21
   • Cost/Benefit Analysis Countermeasure Criteria 00:02:55
   • Calculating Cost/Benefit 00:01:01
   • Controls II 00:02:01
   • Quantitative Analysis 00:02:58
   • Can You Get Rid of All Risk? 00:02:34
   • Uncertainty Analysis 00:01:11
   • Dealing with Risk 00:01:20
   • Management’s Response to Identified Risks 00:01:51
   • Risk Acceptance 00:01:42
   • Risk Analysis Process Summary 00:01:09
   • Components of Security Program 00:00:49
   • A Layered Approach 00:01:22
   • In Security, You Never Want Any Surprises 00:00:52
   • Building Foundation 00:00:46
   • Security Roadmap 00:03:30
   • Functional and Assurance Requirements 00:00:56
   • Most Organizations 00:04:14
   • Silo Security Structure 00:02:27
   • Security Is a Process 00:01:06
   • Approach to Security Management 00:01:05
   • Result of Battling Management 00:00:27
   • Industry Best Practices Standards 00:01:29
   • Pieces and Parts 00:00:54
   • Numbering 00:01:11
   • New ISO Standards 00:01:27
   • COBIT 00:02:23
   • Measurements 00:00:29
   • Information Technology Infrastructure Library 00:01:54
   • Security Governance 00:05:00
   • Security Program Components 00:00:28
   • Policy Framework 00:05:13
   • Standards 00:03:32
   • Data Collection for Metrics 00:02:26
   • Tying Them Together 00:01:45
   • Entity Relationships 00:00:13
   • Senior Management’s Role 00:01:05
   • Security Roles 00:04:07
   • Information Classification 00:00:55
   • Data Leakage 00:00:45
   • Do You Want to End Up In the News? 00:00:53
   • Types of Classification Levels 00:00:47
   • Data Protection Levels 00:00:53
   • Classification Program Steps 00:03:04
   • Classification Levels 00:03:14
   • Information Owner Requirements 00:00:50
   • Clearly Labeled 00:01:01
   • Testing Classification Program 00:00:59
   • Employee Management 00:00:18
   • Employee Position and Management 00:00:47
   • Hiring and Firing Issues 00:02:36
   • Unfriendly Termination 00:02:13
   • Security Awareness and Training 00:01:52
   • Training Characteristics 00:01:13
   • Security Enforcement Issues 00:00:53
   • Answer This Question 00:02:19
   • Domain 1 Review 00:03:12
3. Domain 2 — Access Control
   • Access Control 00:00:39
   • Agenda 1 00:01:16
   • Access Control Mechanism Examples 00:01:03
   • Technical Controls 00:00:54
   • Access Control Characteristics 00:03:25
   • Preventive Controls 00:03:01
   • Control Combinations 00:00:15
   • Detective — Administrative Control 00:02:08
   • Detective Examples 00:00:48
   • Administrating Access Control 00:03:01
   • Authorization Creep 00:00:59
   • Accountability and Access Control 00:01:26
   • Trusted Path 00:03:00
   • Fake Login Pages Look Convincing 00:01:44
   • Who Are You? 00:02:08
   • Identification Issues 00:00:48
   • Authentication Mechanisms Characteristics 00:00:44
   • Strong Authentication 00:02:01
   • Fraud Controls 00:02:41
   • Internal Control Tool: Separation of Duties 00:01:14
   • Authentication Mechanisms in Use Today 00:03:08
   • Verification Steps 00:01:12
   • What a Person Is 00:00:21
   • Why Use Biometrics? 00:01:01
   • Identification or Authentication? 00:01:21
   • Iris Sampling 00:00:40
   • Finger Scan 00:00:58
   • Hand Geometry 00:04:03
   • Downfalls to Biometric Use 00:00:54
   • Biometrics Error Types 00:01:59
   • Crossover Error Rate 00:01:45
   • Biometric System Types 00:02:52
   • Passwords 00:05:06
   • Password Attacks 00:01:05
   • Attack Steps 00:02:50
   • Many Tools to Break Your Password 00:00:53
   • Rainbow Table 00:01:27
   • Passwords Should NOT Contain… 00:01:26
   • Countermeasures for Password Cracking 00:01:06
   • Cognitive Passwords 00:00:47
   • One-Time Password Authentication 00:01:36
   • Synchronous Token 00:01:02
   • One Type of Solution 00:03:09
   • Administrator Configures 00:00:13
   • Challenge Response Authentication 00:04:17
   • Asynchronous Token Device 00:03:27
   • Challenge Response Authentication 00:00:21
   • Cryptographic Keys 00:00:44
   • Passphrase Authentication 00:01:30
   • Key Protection 00:00:25
   • Memory Cards 00:01:25
   • Memory Card Characteristics 00:00:25
   • Smart Card 00:00:56
   • Characteristics 00:01:09
   • Card Types 00:00:50
   • Smart Card Attacks 00:01:34
   • Software Attack 00:01:02
   • Side Channel Attack 00:01:19
   • Side Channel Data Collection 00:00:51
   • Microprobing 00:00:53
   • Identity Management 00:02:19
   • How Are These Entities Controlled? 00:00:55
   • Some Current Issues 00:01:22
   • Management 00:03:01
   • Typical Chaos 00:00:49
   • Different Identities 00:01:45
   • Identity Management Technologies 00:00:48
   • Directory Component 00:01:17
   • Enterprise Directory 00:00:48
   • Directory Responsibilities 00:01:03
   • Authoritative Sources 00:01:47
   • Meta Directory 00:02:26
   • Directory Interactions 00:01:46
   • Web Access Management 00:01:27
   • Web Access 00:05:09
   • Password Management 00:02:21
   • Legacy Single Sign-On 00:02:47
   • Account Management Systems 00:02:23
   • Provisioning Component 00:04:42
   • Profile Update 00:01:29
   • Working Together 00:03:29
   • Enterprise Directory 00:01:00
   • Identity Management Solution Components 00:02:52
   • Federated Identity 00:02:59
   • Identity Theft 00:01:19
   • Fake Login Tools 00:02:17
   • Instructional Emails 00:01:26
   • Knowing What You Are Disposing of Is Important 00:01:18
   • Other Examples 00:00:46
   • Another Danger to Be Aware of… Spyware 00:02:07
   • Is Someone Watching You? 00:02:11
   • What Does This Have to Do with My Computer? 00:01:37
   • New Spyware Is Being Identified Every Week 00:01:09
   • How to Prevent Spyware 00:01:19
   • Different Technologies 00:00:57
   • Single Sign-on Technology 00:04:21
   • Security Domain 00:01:27
   • Domains of Trust 00:01:03
   • Thin Clients 00:00:59
   • Example 00:01:13
   • Kerberos as a Single Sign-on Technology 00:13:13
   • Tickets 00:03:43
   • Why Go Through All of this Trouble? 00:01:02
   • Issues Pertaining to Kerberos 00:01:25
   • Kerberos Issues 00:01:31
   • SESAME as a Single Sign-on Technology 00:00:38
   • SESAME Steps for Authentication 00:02:18
   • Combo 00:01:22
   • Models for Access 00:00:54
   • Access Control Models 00:01:00
   • ACL Access 00:01:51
   • File Permissions 00:01:09
   • Security Issues 00:01:20
   • Mandatory Access Control Model 00:01:50
   • MAC Enforcement Mechanism — Labels 00:02:06
   • Formal Model 00:00:57
   • Software and Hardware 00:00:58
   • Software and Hardware Guards 00:02:25
   • MAC versus DAC 00:01:14
   • Role-Based Access Control 00:01:14
   • RBAC Hierarchy 00:03:17
   • Rule-Based Access Control 00:02:16
   • Firewall Example 00:00:14
   • Access Control Matrix 00:02:11
   • Temporal Access Control 00:00:54
   • Access Control Administration 00:02:13
   • Remote Centralized Administration 00:01:35
   • RADIUS 00:01:34
   • RADIUS Characteristics 00:01:17
   • TACACS+ Characteristics 00:01:36
   • Diameter Characteristics 00:02:27
   • Diameter Protocol 00:01:01
   • Mobile IP 00:01:36
   • Diameter Architecture 00:01:41
   • Two Pieces 00:01:09
   • AVP 00:03:46
   • Decentralized Access Control Administration 00:01:45
   • Controlling Access to Sensitive Data 00:04:51
   • IDS 00:02:19
   • IDS Steps 00:01:26
   • Network IDS Sensors 00:02:00
   • Host IDS 00:01:31
   • Combination 00:01:38
   • Types of IDSs 00:02:32
   • Signature-Based Example 00:02:29
   • Behavior-Based IDS 00:03:32
   • Statistical Anomaly 00:01:05
   • Statistical IDS 00:00:45
   • Protocol Anomaly 00:01:45
   • What Is a Protocol Anomaly? 00:01:30
   • Protocol Anomaly Issues 00:00:48
   • Traffic Anomaly 00:03:47
   • IDS Response Mechanisms 00:01:10
   • Responses to Attacks 00:01:37
   • IDS Issues 00:04:38
   • Vulnerable IDS 00:02:30
   • Domain 2 Review 00:02:29
4. Domain 3 — Cryptography
   • Cryptography 00:01:58
   • Services Provided by Cryptography 00:01:13
   • Cryptographic Definitions 00:01:15
   • Cipher 00:01:36
   • A Few More Definitions 00:02:33
   • Symmetric Cryptography — Use of Secret Keys 00:01:23
   • Scytale Cipher 00:01:03
   • Substitution Ciphers 00:01:55
   • Simple Substitution Cipher Atbash 00:01:31
   • Caesar Cipher Example 00:01:47
   • Simple Substitution Cipher ROT13 00:01:33
   • Historical Uses 00:02:10
   • Vigenere Algorithm 00:01:54
   • Enigma Machine 00:05:45
   • Historical Uses of Symmetric Cryptography — Running Key and Concealment 00:03:01
   • Agenda 1 00:00:15
   • Transposition Ciphers 00:01:15
   • Key and Algorithm Relationship 00:04:22
   • Ways of Breaking Cryptosystems — Brute Force 00:01:53
   • Brute Force Components 00:00:44
   • Ways of Breaking Cryptosystems — Frequency Analysis 00:01:40
   • Strength of a Cryptosystem 00:02:17
   • Developing Cryptographic Solutions In-House 00:01:15
   • Characteristics of Strong Algorithms 00:02:48
   • Open or Closed More Secure? 00:01:23
   • Types of Ciphers Used Today 00:01:48
   • S-Boxes Used in Block Ciphers 00:01:33
   • Binary Mathematical Function 1 00:01:25
   • Type of Symmetric Cipher — Stream Cipher 00:01:43
   • Symmetric Characteristics 00:00:47
   • Initialization Vectors 00:01:42
   • Security Holes 00:05:07
   • Strength of a Stream Cipher 00:02:32
   • Out-of-Band Transmission 00:01:57
   • Symmetric Key Management Issue 00:03:26
   • Asymmetric Cryptography 00:00:57
   • Key Functions 00:00:55
   • Public Key Cryptography Advantages 00:02:53
   • Asymmetric Algorithm Disadvantages 00:01:14
   • Confusing Names 00:01:39
   • Symmetric versus Asymmetric 00:00:59
   • Questions 1 00:04:29
   • When to Use Which Key 00:02:23
   • Encryption Steps 00:02:28
   • Receiver’s Public Key Is Used to Encrypt the Symmetric Key 00:00:42
   • Receiver’s Private Key Is Used to Decrypt the Symmetric Key 00:01:16
   • Digital Envelope 00:01:07
   • Secret versus Session Keys 00:01:01
   • Asymmetric Algorithms We Will Dive Into 00:01:29
   • Diffie-Hellman 00:05:06
   • Key Agreement Schemes 00:00:49
   • Asymmetric Algorithm — RSA 00:01:35
   • Factoring Large Numbers 00:01:57
   • RSA Operations 00:01:08
   • RSA Key Size 00:01:01
   • El Gamal 00:02:42
   • Asymmetric Mathematics 00:03:34
   • Asymmetric Security 00:00:46
   • Mathematics 00:06:55
   • Block Cipher 00:01:07
   • Double DES 00:01:36
   • Evolution of DES 00:00:59
   • Modes of 3DES 00:01:14
   • Encryption Modes 00:01:42
   • Block Cipher Modes — CBC 00:02:29
   • Different Modes of Block Ciphers — ECB 00:01:29
   • ECB versus CBC 00:00:31
   • Block Cipher Modes — CFB and OFB 00:04:06
   • CFB and OFB Modes 00:01:42
   • Counter Mode 00:02:47
   • Modes Summary 00:01:46
   • Symmetric Ciphers 00:03:44
   • Data Integrity 00:00:52
   • Hashing Steps 00:01:06
   • Protecting the Integrity of Data 00:01:01
   • Hashing Algorithms 00:02:22
   • Data Integrity Mechanisms 00:01:23
   • Hashing Strength 00:00:35
   • Question 1 00:00:22
   • Weakness In Using Only Hash Algorithms 00:00:44
   • More Protection In Data Integrity 00:00:40
   • MAC 00:01:12
   • HMAC — Sender 00:01:50
   • Another Look 00:01:03
   • What Services 00:01:03
   • CBC-MAC 00:01:42
   • MAC Using Block Ciphers 00:00:59
   • Integrity? 00:01:00
   • What Services? 00:01:30
   • Question 2 00:01:26
   • Digital Signatures 00:02:43
   • U.S. Government Standard 00:01:04
   • What Is… 00:00:20
   • Not Giving Up the Farm 00:00:52
   • Zero Knowledge Proof 00:01:07
   • Message Integrity Controls 00:01:01
   • Security Issues In Hashing 00:01:22
   • Example of a Birthday Attack 00:03:00
   • Birthday Attack Issues 00:00:52
   • Key Management 00:02:50
   • Key Usage 00:02:13
   • M-of-N 00:01:47
   • Key Types 00:01:22
   • Why Do We Need a PKI? 00:01:17
   • PKI and Its Components 00:02:51
   • RA Roles 00:02:29
   • CA 00:02:10
   • Digital Certificates 00:02:25
   • Certificate 00:00:45
   • Signing the Certificate 00:00:52
   • Verifying the Certificate 00:03:34
   • Trusted CA’s 00:01:30
   • Non-Trusted CA 00:03:29
   • What Do You Do with a Certificate? 00:05:01
   • Components of PKI, Repository, and CRLs 00:02:21
   • Revoked? 00:01:50
   • CRL Process 00:02:45
   • Different Uses for Certificates 00:02:12
   • Cross Certification 00:02:58
   • PKI and Trust 00:01:41
   • Historical Uses of Symmetric Cryptography 00:01:31
   • Binary Mathematical Function 2 00:02:19
   • One-Time Pad in Action 00:00:45
   • One-Time Pad Characteristics 00:03:32
   • Steganography 00:01:57
   • Digital Watermarking 00:01:11
   • Link versus End-to-End Encryption 00:03:02
   • End-to-End Encryption 00:01:28
   • Encryption Location 00:01:15
   • Email Standards 00:02:16
   • You Decide 00:02:40
   • Non-Hierarchical 00:01:48
   • Secure Protocols 00:02:18
   • SSL Connection Setup 00:04:13
   • Example — SSL 00:01:09
   • Validating Certificate 00:00:58
   • Secure Protocols (Cont.) 00:02:16
   • SSL and the OSI Model 00:01:57
   • E-Commerce 00:04:15
   • How Are You Doing? 00:01:28
   • Secure Email Standard 00:02:05
   • Network Layer Protection 00:02:58
   • IPSec Key Management 00:01:48
   • IPSec Handshaking Process 00:01:00
   • VPN Establishment 00:01:55
   • SAs In Use 00:03:04
   • Key Issues within IPSec 00:01:52
   • Configuration of SA Parameters 00:00:32
   • IPSec Configuration Options 00:00:45
   • IPSec Is a Suite of Protocols 00:03:17
   • AH and ESP Modes 00:02:13
   • IPSec Modes of Operation 00:01:14
   • VPN Establishment (Cont.) 00:02:04
   • Review 00:02:08
   • Questions 2 00:02:20
   • Attack Types 00:00:43
   • Attacks on Cryptosystems 00:01:23
   • Known-Plaintext Attack 00:01:53
   • Chosen-Plaintext Attack 00:01:11
   • Chosen-Ciphertext Attack 00:02:01
   • Adaptive Attacks 00:01:00
   • Side Channel Attacks 00:01:17
   • Domain 3 Review 00:03:12
5. Domain 4 — Physical Security
   • Physical Security 00:01:29
   • Different Types of Threats 00:00:42
   • Wake Up Call 00:01:35
   • Legal Issues 00:00:55
   • Physical Security Program Goals 00:01:41
   • Planning Process 00:02:10
   • Deterrence 00:01:35
   • Delay 00:00:19
   • Layered Defense Model 00:01:53
   • Weak Link In the Chain 00:00:41
   • Threat Categories 00:01:20
   • Crime Prevention Through Environmental Design 00:06:35
   • Construction Materials 00:07:40
   • Security Zones 00:06:43
   • Entrance Protection 00:09:06
   • Perimeter Security — Security Guards 00:08:10
   • Types of Physical Intrusion Detection Systems 00:05:24
   • Alarm Systems 00:07:11
   • Electrical Power 00:09:21
   • Fire Prevention 00:16:13
   • Domain 4 Review 00:08:11
6. Domain 5 — Security Architecture and Design
   • Security Architecture and Design 00:02:42
   • Central Processing Unit (CPU) 00:01:40
   • Registers 00:03:42
   • Trust Levels and Processes 00:03:37
   • Interrupts 00:04:31
   • Bussses 00:02:40
   • Multiprocessing and Multitasking 00:08:55
   • Memory Types 00:16:33
   • CPU and OS 00:24:15
   • Trusted Computing Base 00:15:30
   • Security Levels 00:05:06
   • Enterprise Architecture 00:21:03
   • Access Control Models 00:06:47
   • Bell-LaPadula 00:13:44
   • Clark-Wilson Model 00:04:53
   • Non-Interference Model 00:04:51
   • Access Control Matrix Model 00:05:40
   • Trusted Computer System Evaluation Criteria (TCSEC) 00:15:31
   • Domain 5 Review 00:23:57
7. Domain 6 — Law, Investigation and Ethics
   • Law, Investigation and Ethics 00:01:42
   • Examples of Computer Crimes 00:01:00
   • Who Perpetrates These Crimes? 00:03:11
   • A Few Attack Types 00:04:49
   • Privacy of Sensitive Data 00:05:31
   • Different Types of Laws 00:05:28
   • Computer Crime and Its Barriers 00:13:18
   • Preparing for a Crime Before It Happens 00:25:08
   • Domain 6 Review 00:10:04
8. Domain 7 — Telecommunications and Networking
   • Telecommunications and Networking 00:00:48
   • OSI Model 00:03:09
   • Networking Communications 00:04:22
   • Application Layer 00:02:33
   • Presentation Layer 00:02:37
   • OSI — Session Layer 00:03:12
   • Transport Layer 00:03:00
   • Network Layer 00:02:46
   • Data Link Layer 00:05:52
   • Physical Layer 00:01:33
   • Layers Working Together 00:10:43
   • Network Topologies 00:06:32
   • LAN Media Access Technologies 00:02:45
   • Media Access Technologies 00:13:02
   • Cabling Types-Coaxial 00:01:39
   • Cabling Types — Twisted Pair 00:01:51
   • Types of Cabling — Fiber 00:01:47
   • Signal and Cable Issues 00:01:56
   • Transmission Types 00:11:52
   • Network Technologies 00:03:48
   • Networking Devices 00:06:20
   • Virtual LANs 00:04:31
   • Sniffers 00:03:13
   • Networking Devices — Router 00:02:15
   • Hops 00:00:56
   • Routers 00:00:49
   • Bridges Compared to Routers 00:01:29
   • Port and Protocol Relationship 00:05:24
   • TCP/IP Suite 00:01:09
   • UDP versus TCP 00:02:29
   • TCP Segment 00:00:50
   • SYN Flood 00:03:29
   • Teardrop Attack 00:02:05
   • Source Routing 00:01:03
   • Source Routing Types 00:00:52
   • IP Address Ranges 00:02:56
   • IPv6 00:02:25
   • Protocols 00:00:11
   • Protocols — ARP 00:01:09
   • IP to MAC Mapping 00:00:50
   • How ARP Works 00:01:27
   • ARP Poisoning 00:01:13
   • ICMP Packets 00:01:22
   • A Way Hackers Use ICMP 00:01:19
   • Ping Steps 00:01:30
   • Protocols — SNMP 00:00:49
   • SNMP In Action 00:03:20
   • SNMP 00:01:48
   • SNMP Output 00:00:58
   • POP3 and SMTP 00:01:20
   • Mail Relay 00:02:00
   • Protocols — FTP, TFTP, Telnet 00:02:36
   • Protocols — RARP and BootP 00:01:18
   • DHCP — Dynamic Host Configuration Protocol 00:01:04
   • Networking Device — Bastion Host 00:04:01
   • Network Devices — Firewalls 00:06:37
   • Rule Set Example 00:01:22
   • Firewall Types — Proxy Firewalls 00:01:50
   • Firewall Types — Circuit-Level Proxy Firewall 00:01:48
   • Circuit-Level Proxy 00:05:44
   • Dedicated Proxy Servers 00:21:54
   • Dial-Up Protocols and Authentication Protocols 00:04:55
   • Authentication Protocols 00:08:07
   • Virtual Private Network Technologies 00:19:32
   • SDLC and HDLC 00:04:42
   • Quality of Service (QoS) 00:02:37
   • Autonomous Systems 00:02:04
   • Routing Protocols 00:10:53
   • Routing Protocol Attacks 00:17:26
   • Network Service — NAT 00:06:32
   • WAN Technologies Are Circuit or Packet Switched 00:01:10
   • PSTN 00:02:24
   • Multiplexing 00:01:40
   • Types of Multiplexing 00:04:02
   • Packet Switching 00:03:52
   • WAN Technologies — Packet Switched 00:00:17
   • WAN Technologies — X.25 00:00:54
   • X.25 00:01:09
   • WAN Technologies — Frame Relay 00:01:47
   • WAN Example 00:00:44
   • Frame Relay 00:02:26
   • WAN Technologies — ATM 00:01:21
   • Cell Switching 00:00:46
   • Wide Area Network Technologies 00:05:50
   • WAN Technologies — Cable Modem 00:01:37
   • Cable Modems and Satellites 00:03:38
   • Network Perimeter Security 00:01:03
   • Complexity Only Increases 00:01:04
   • Agenda 9 00:01:21
   • PSTN (Cont.) 00:01:54
   • Private Branch Exchange 00:01:50
   • PBX Vulnerabilities 00:01:33
   • PBX Best Practices 00:01:44
   • IP Telephony 00:14:39
   • Mobile Phone Security 00:01:23
   • Mobile Device Security 00:01:22
   • Cell Phone 00:02:40
   • Wireless Technologies 00:15:20
   • OFDM 00:02:52
   • 802.11n 00:01:09
   • Wireless Technologies — Access Point (Cont.) 00:01:01
   • Architectures 00:00:46
   • Wireless Technologies — Service Set ID 00:01:46
   • Authenticating to an AP 00:01:03
   • 802.11 Authentication 00:02:27
   • Wireless Technologies — WEP Woes 00:07:43
   • 802.11 Security Solutions 00:10:40
   • Types of 802.11 Security 00:03:30
   • Wireless EAP 00:23:20
   • Wireless Technologies — WAP and WTLS 00:03:52
   • Instant Messaging 00:03:02
   • Domain 7 Review 00:01:40
9. Domain 8 — Business Continuity
   • Business Continuity 00:01:06
   • Needs for BCP 00:03:49
   • 9/11 Changed Mentalities About BCP 00:03:07
   • Do We Have a Plan? 00:02:15
   • What Is the Purpose of a BCP? 00:02:26
   • More Reasons to Have Plans in Place 00:02:41
   • BCP Is a Core Component of Every Security Program 00:01:01
   • Steps of BCP Process 00:01:57
   • Different BCP Model 00:01:15
   • Documentation 00:01:08
   • BCP Policy Outlines 00:01:43
   • Who Is In Charge and Who Can We Blame? 00:01:52
   • What’s Needed In a Team? 00:00:51
   • BCP Development Team 00:01:31
   • Project Sizing 00:01:44
   • Properly Determining Scope Is Important 00:00:50
   • BCP Risk Analysis Steps 00:02:11
   • BIA Steps 00:01:28
   • Information from Different Sources 00:01:18
   • Analysis 00:01:31
   • How to Identify the Most Critical Company Functions 00:02:46
   • Interdependencies 00:00:45
   • Well, Of Course an Organization Knows How It Works! 00:00:54
   • Business Silos 00:05:42
   • Maximum Tolerable Downtime 00:05:30
   • Range of Threats to Consider 00:02:42
   • Thinking Outside of the Box What If… 00:00:55
   • Biological Threats 00:00:46
   • BIA Steps (Cont.) 00:00:56
   • Potential Disasters 00:02:26
   • Risk Approach 00:03:28
   • What Have We Completed Up to Now? 00:02:39
   • Recovery Strategies 00:01:17
   • Alternate Business Process Procedures 00:02:36
   • Business Process Reconstruction 00:01:46
   • Recovery Strategies 00:00:55
   • Facility Backups 00:02:33
   • Compatibility Issues with Offsite Facility 00:02:04
   • Tertiary Sites 00:00:56
   • Subscription Costs 00:02:17
   • Multiple Processing Centers 00:01:03
   • Choosing Site Location 00:00:56
   • Other Offsite Approaches 00:01:51
   • Security Does Not Stop 00:01:12
   • More Options 00:02:01
   • Rolling Hot Site 00:00:58
   • Recovery Strategies (Cont.) 00:00:41
   • Supply and Technology Recovery 00:01:44
   • VoIP 00:01:07
   • Equipment Replacement 00:03:23
   • What Items Need to Be Considered? 00:01:31
   • Priorities 00:01:05
   • Executive Succession Planning 00:01:29
   • Recovery Strategies (Cont.) 00:03:14
   • Co-Location 00:00:51
   • Data Recovery 00:01:52
   • Backup Redundancy 00:01:52
   • Recovering Data 00:00:41
   • Automated Backup Technologies 00:02:05
   • Tape Vaulting 00:02:40
   • Clustering for Fault Tolerance 00:01:30
   • Disk or Database Shadowing 00:05:28
   • Cost and Recovery Times 00:02:04
   • Recovery Solutions 00:00:48
   • Preventative Measures 00:01:18
   • Reviewing Insurance 00:00:50
   • Results from the BIA 00:01:42
   • Basic Structure of BCP 00:04:04
   • External Groups 00:01:29
   • Activation Phase 00:07:51
   • Reconstitution Phase 00:02:37
   • Who Goes First? 00:00:56
   • Disaster Hit — Now What? 00:01:05
   • Termination of BCP 00:01:05
   • Life Cycle 00:02:12
   • Types of Tests to Choose From 00:03:49
   • Test Objectives 00:01:02
   • Training Requirements 00:01:58
   • What Is Success? 00:00:51
   • Out of Date? 00:01:01
   • Keeping It Current 00:00:52
   • Change Control 00:00:58
   • Resulting Plan Should Contain… 00:01:24
   • Phases of the BCP 00:00:54
   • Domain 8 Review 00:03:16
10. Domain 9 — Application Security
    • Application Security 00:01:24
    • How Did We Get Here? 00:00:50
    • Why Are We Not Improving at a Higher Rate? 00:01:54
    • Usual Trend of Dealing with Security 00:02:17
    • Software Development Tools 00:02:48
    • Security Issues 00:01:12
    • Language Types 00:04:06
    • Turn Into Machine Code 00:01:16
    • New and Old 00:00:55
    • Object-Oriented Programming 00:01:07
    • Classes and Objects 00:02:29
    • Functions and Messages 00:01:45
    • Object-Oriented Programming Characteristic 00:01:12
    • Polymorphism 00:02:29
    • Module Characteristics 00:00:56
    • Low Cohesion 00:01:06
    • Coupling 00:00:48
    • Agenda 2 00:01:21
    • Distributed Computing 00:00:56
    • Distributed Computing — ORBs 00:00:50
    • Common Object Request Broker Architecture 00:00:41
    • COM Architecture 00:01:38
    • Enterprise Java Beans 00:00:51
    • J2EE Platform Example 00:01:32
    • Linking Through COM 00:02:03
    • Mobile Code with Active Content 00:03:14
    • Java and Applets 00:02:59
    • Database Systems 00:01:37
    • Database Model 00:03:23
    • Object-Oriented Database 00:01:00
    • Benefits of OO Database Model 00:01:41
    • Database Models — Relational Components 00:04:46
    • Database Integrity 00:01:24
    • Different Modeling Approaches 00:01:16
    • Database Access Methods 00:06:18
    • Database Connectivity 00:01:57
    • Database Security Mechanisms 00:02:12
    • Rollback Control 00:01:11
    • Checkpoint Control 00:00:46
    • Checkpoint Protection 00:01:12
    • Lock Controls 00:00:48
    • Deadlock Example 00:01:34
    • Two-Phase Commit 00:00:42
    • Lock Controls Help to Provide ACID 00:03:03
    • Inference Attack 00:01:09
    • Database View Control 00:00:56
    • Common Components 00:00:41
    • Data Warehousing 00:03:08
    • Using a Data Warehouse 00:01:21
    • Metadata 00:00:11
    • Database Component 00:01:30
    • Data Mart 00:02:23
    • Potential Malicious Traffic Tunneling Through Port 80 00:01:46
    • OLTP 00:02:44
    • Knowledge Management 00:00:43
    • Knowledge Components 00:00:43
    • HR Example 00:00:57
    • Knowledge Discovery In Databases 00:01:30
    • Expert Systems 00:04:15
    • Software Development Models 00:03:49
    • Project Development — Phases I through V 00:01:01
    • Project Development — Phases VI and VII 00:01:06
    • Testing Types 00:01:58
    • Data Contamination Controls 00:01:02
    • Best Practices for Testing 00:01:18
    • Test for Specific Threats 00:01:31
    • Verification versus Validation 00:01:01
    • Evaluating the Resulting Product 00:01:09
    • Controlling How Changes Take Place 00:02:58
    • Administrative Controls 00:02:38
    • Common Information Flow 00:02:42
    • Tier Approach and Communication Components 00:01:00
    • Tiered Network Architectures 00:00:58
    • Sensitive Data Availability 00:05:09
    • Cookies 00:04:24
    • Find Out Where You Have Been 00:00:57
    • Pulling Data 00:01:46
    • Provide the Hackers with Tools 00:02:09
    • Common Web Server Flaws 00:01:08
    • Improper Data Validation 00:01:59
    • Uniform Resource Locator (URL) 00:02:00
    • Directory Traversal 00:01:04
    • Buffer Overflow 00:00:57
    • Cross-Site Scripting Attack 00:01:51
    • Common SQL Injection Attack 00:01:30
    • Attacking Mis-configurations 00:01:12
    • CGI Information 00:03:19
    • Authentication 00:00:52
    • Protecting Traffic 00:06:40
    • Rolling ‘em Out 00:04:30
    • Virus 00:04:46
    • More Malware 00:01:48
    • Trojans 00:02:39
    • A Back Orifice Attack! 00:00:59
    • NetBus and Hoaxes 00:01:35
    • Malware Protection Types 00:01:02
    • Signature Scanning 00:00:58
    • Monitoring Activities 00:00:56
    • Monitoring for Changes 00:01:21
    • More Bad Stuff 00:02:01
    • Disclosing Data In an Unauthorized Manner 00:01:32
    • Covert Timing Channel 00:01:03
    • Circumventing Access Controls 00:01:17
    • Attacks 00:01:29
    • Attack Type — Race Condition 00:05:43
    • How a Buffer Overflow Works 00:01:39
    • Watching Network Traffic 00:01:23
    • Traffic Analysis 00:01:07
    • Functionally Two Different Types of Rootkits 00:01:19
    • Examples of Trojaned Files 00:00:48
    • Domain 9 Review 00:03:56
    • More Bad Stuff 00:02:01
    • Disclosing Data In an Unauthorized Manner 00:01:32
    • Covert Timing Channel 00:01:03
    • Circumventing Access Controls 00:01:17
    • Attacks 00:01:29
    • Attack Type — Race Condition 00:05:43
    • How a Buffer Overflow Works 00:01:39
    • Watching Network Traffic 00:01:23
    • Traffic Analysis 00:01:07
    • Functionally Two Different Types of Rootkits 00:01:19
    • Examples of Trojaned Files 00:00:48
    • Domain 9 Review 00:03:56
11. Domain 10 — Operations Security
    • Operations Security 00:02:02
    • Computer Operations 00:04:19
    • Problem Management Procedures for Processing Problems 00:01:11
    • Higher Level Look 00:00:36
    • Administrative Controls Personnel Controls 00:05:50
    • Resource Protection 00:02:03
    • Media Labels and Controls 00:01:19
    • Software Escrow 00:01:22
    • Media Reuse 00:05:33
    • Why Not Just Delete the Files? 00:02:57
    • Backups 00:01:42
    • Backup Types 00:01:08
    • Incremental Backup 00:01:15
    • Incremental 00:02:35
    • Differential Backup 00:03:19
    • Mean Time Between Failure 00:01:37
    • Mean Time to Repair 00:01:30
    • Redundant and Fault Tolerance 00:02:32
    • Mirroring Data 00:00:59
    • Direct Access Storage Device 00:07:27
    • Serial Advanced Technology Architecture 00:00:50
    • SAN 00:01:13
    • Fault Tolerance 00:02:05
    • Redundancy Mechanism 00:01:40
    • Some Threats to Computer Operations 00:00:51
    • Trusted Recovery of Software 00:01:10
    • After System Crash 00:00:51
    • Security Concerns 00:01:32
    • Contingency Planning 00:01:23
    • Remote Access Security 00:09:23
    • Before Carrying Out Vulnerability Testing 00:00:58
    • Testing for Vulnerabilities 00:01:20
    • Security Testing Issues 00:02:07
    • Vulnerability Scanning 00:01:42
    • Data Leakage — Keystroke Logging 00:00:58
    • Password Cracking 00:02:10
    • War Dialing 00:02:16
    • War Driving 00:03:26
    • Penetration Testing 00:10:05
    • Post-Testing and Assessment Steps 00:02:14
    • Penetration Testing Variations 00:00:55
    • Types of Testing 00:01:17
    • Protection Mechanism — Honeypot 00:01:49
    • Log Reviews 00:01:00
    • Domain 10 Review 00:07:06
    • Course Closure 00:24:37



9780789740106.CISSP.Video.Course.part1.OR.rar

9780789740106.CISSP.Video.Course.part2.OR.rar