(My) CISSP Notes – Bibliography

This is the last ticket from/for “(My) CISSP Notes” and will contains links to the materials that I used for the preparation of the exam.


  • CISSP study guide – This was my main source of information.
  • CISSP for dummies – This was my second source of information; very easy to read and understand but not sufficient to pass the exam.
  • 11th Hour CISSP: Study guide – This is a short version of the CISSP study guide . I use it for a quick review the last few days before the exam.
  • CISSP Boxed Set – This box set contains a study guide and a book with practice exams. I used the study guide only punctually for specific topics and I found it very complete. I tried at the beginning the use it as the main source of information but the main problem is the huge quantity of information (1400 pages).

Practice Exams

Audio Postcasts

  • McGraw-Hill Education CISSP Podcasts – The podcasts are covering all the domains and are of quite good (audio) quality.  If you don’t have the time to listen everything then you could choose the listen only the review podcasts containing only the most important information.

(My) CISSP Notes – Security Operations

Note: This notes were made using the following books: “CISPP Study Guide” and “CISSP for dummies”.

Operations Security is concerned with threats to a production operating environment.

So operations security is about people, data, media, hardware, and the threats associated with each of these in a production environment.

Administrative security

One fundamental aspect of operations security is ensuring that controls are in place to inhibit people either inadvertently or intentionally compromising the confidentiality, integrity, or availability of data or the systems and media holding that data. Administrative Security provides the means to control people’s operational access to data.

Administrative personnel controls :

  • least privilege – the principle of least privilege dictates that persons have no more than the access that is strictly required for the performance of their duties.
  • need to know – only people with a valid need to know certain information in order to perform their job functions, should have access to that information.An extension to the principle of least privilege in MAC environments is the concept of compartmentalizationCompartmentalization, a method for enforcing need to know, goes beyond the mere reliance upon clearance level and necessitates simply that someone requires access to information.
  • separation of duties –  prescribes that multiple people are required to complete critical or sensitive transactions.The goal of separation of duties is to ensure that in order for someone to be able to abuse their access to sensitive data or transactions; they must convince another party to act in concert. Collusion is the term used for the two parties conspiring to undermine the security of the transaction.
  • rotation of duties – also known as job rotation or rotation of responsibilities, provides an organization with a means to help mitigate the risk associated with any one individual having too many privileges.Rotation of duties simply requires that critical functions or responsibilities are not continuously performed by the same single person without interruption.
  • mandatory leave – an additional operational control that is closely related to rotation of duties is that of mandatory leave, also known as forced vacation.
  • non-disclouse agreement (NDA) – is a work-related contractual agreement that ensures that, prior to being given access to sensitive information or data, an individual or organization appreciates their legal responsibility to maintain the confidentiality of sensitive information.
  • background checks – also known as background investigations or preemployment screening; are an additional administrative control commonly employed by many organizations.

Sensitive information/media security

Wherever the data exists, there must be processes that ensure the data is not destroyed or inaccessible (a breach of availability), disclosed, (a breach of confidentiality) or altered (a breach of integrity).

Perhaps the most important step in media security is the process of locating sensitive information, and labeling or marking it as sensitive.

People handling sensitive media should be trusted individuals who have been vetted by the organization.

When storing sensitive information, it is preferable to encrypt the data. Encryption of data at rest greatly reduces the likelihood of the data being disclosed in an unauthorized fashion due to media security issues.

The term data remanence is important to understand when discussing media sanitization and data destruction. Data remanence is data that persists beyond noninvasive means to delete it.

Wiping, also called overwriting or shredding, writes new data over each bit or block of file data.

By introducing an external magnetic field through use of a degausser, the data on magnetic storage media can be made unrecoverable.

Asset management

  • Patch management – One of the most basic, yet still rather difficult, tasks associated with maintaining strong system security configuration is patch management, the process of managing software updates.
  • Vulnerability management – Vulnerability scanning is a way to discover poor configurations and missing patches in an environment. While it might seem obvious, it bears mentioning that vulnerability scanning devices are only capable of discovering the existence of known vulnerabilities. The term vulnerability management is used rather than just vulnerability scanning to emphasize the need for management of the vulnerability information.
  • Change management – In order to maintain consistent and known operational security, a regimented change management or change control process needs to be followed. The purpose of the change control process is to understand, communicate, and document any changes with the primary goal of being able to understand, control, and avoid direct or indirect negative impact that the change might impose.

Continuity of operation

Three basic types of backups exist:

  • full backup – is the easiest to understand of the types of backup; it simply is a replica of all allocated data on a hard disk. Full backups contain all of the allocated data on the hard disk, which makes them simple from a recovery standpoint in the event of a failure.
  • incremental backup – one alternative to exclusively relying upon full backups is to leverage incremental backups. Incremental backups only archive files that have changed since the last backup of any kind was performed. Since fewer files are backed up, the time to perform the incremental backup is greatly reduced.
  • differential backup – while the incremental backup only archived those files that had changed since any backup, the differential method will back up any files that have been changed since the last full backup.

Redundant array of inexpensive disks (RAID)

The goal of a Redundant Array Inexpensive Disks (RAID) is to help mitigate the risk associated with hard disk failures.

Three terms that are important to understand with respect to RAID are:

  • mirroring – is the most obvious and basic of the fundamental RAID concepts, and is simply used to achieve full data redundancy by writing the same data to multiple hard disks.
  • striping – is a RAID concept that is focused on increasing the read and write performance by spreading data across multiple hard disks. With data being spread amongst multiple disk drives, reads and writes can be performed in parallel across multiple disks rather than serially on one disk.
  • parity – is a means to achieve data redundancy without incurring the same degree of cost as that of mirroring in terms of disk usage and write performance.

RAID 0: Striped Set As is suggested by the title, RAID 0 employs striping to increase the performance of read and writes. By itself, striping offers no data redundancy so RAID 0 is a poor choice if recovery of data is the reason for leveraging RAID.

RAID 1: Mirrored Set This level of RAID is perhaps the simplest of all RAID levels to understand. RAID 1 creates/writes an exact duplicate of all data to an additional disk. The write performance is decreased, though the read performance can see an increase.

RAID 2: Hamming Code RAID 2 is not considered commercially viable for hard disks and is not used. This level of RAID would require either 14 or 39 hard disks and a specially designed hardware controller, which makes RAID 2 incredibly cost prohibitive. RAID 2 is not likely to be tested.

RAID 3: Striped Set with Dedicated Parity (byte level) Striping is desirable due to the performance gains associated with spreading data across multiple disks. However, striping alone is not as desirable due to the lack of redundancy. With RAID 3 data, at the byte level, is striped across multiple disks, but an additional disk is leveraged for storage of parity information, which is used for recovery in the event of a failure.

RAID 4: Striped Set with Dedicated Parity (block level) RAID 4 provides the exact same configuration and functionality as that of RAID 3, but stripes data at the block, rather than byte, level.

RAID 5: Striped Set with Distributed Parity One of the most popular RAID configurations is that of RAID 5, Striped Set with Distributed Parity. Again with RAID 5 there is a focus on striping for the performance increase it offers, and RAID 5 leverages a block level striping. Like RAIDs 3 and 4, RAID 5 writes parity information that is used for recovery purposes. However, unlike RAIDs 3 and 4, which require a dedicated disk for parity information, RAID 5 distributes the parity information across multiple disks.

RAID 6: Striped Set with Dual Distributed Parity While RAID 5 accommodates the loss of any one drive in the array, RAID 6 can allow for the failure of two drives and still function. This redundancy is achieved by writing the same parity information to two different disks.

System redundancy

The most common example of this in-built redundancy is systems or devices which have redundant onboard power in the event of a power supply failure. In addition to redundant power, it is also common to find redundant network interface cards (NICs), as well as redundant disk controllers.

Some applications and systems are so critical that they have more stringent uptime requirements than can be met by standby redundant systems, or spare hardware. These systems and applications typically require what is commonly referred to as a high-availability (HA) or failover cluster. A high-availability cluster employs multiple systems that are already installed, configured, and plugged in, such that if a failure causes one of the systems to fail then the other can be seamlessly leveraged to maintain the availability of the service or application being provided.

Incident response management

Incident handling or incident response are the terms most commonly associated with how an organization proceeds to identify, react, and recover from security incidents.

Computer Security Incident Response Team (CSIRT) is a term used for the group that is tasked with monitoring, identifying, and responding to security incidents.

Phases of incident responses :

  • detection – one of the most important steps in the incident response process is the detection phase. Detection is the phase in which events are analyzed in order to determine whether these events might comprise a security incident.
  • containment – is the point at which the incident response team attempts to keep further damage from occurring as a result of the incident.This phase is also typically where a binary (bit by bit) forensic backup is made of systems involved in the incident.
  • eradication – involves the process of understanding the cause of the incident so that the system can be reliably cleaned and ultimately restored to operational status later in the recovery phase.
  •  recovery – involves cautiously restoring the system or systems to operational status.
  • reporting – is the one most likely to be neglected in immature incident response programs. This fact is unfortunate because the reporting phase, if done right, is the phase that has the greatest potential to effect a positive change in security posture. The goal of the reporting phase is to provide a final report on the incident, which will be delivered to management.

(My) CISSP Notes – Physical Security

Note: This notes were made using the following books: “CISPP Study Guide” and “CISSP for dummies”.

Physical (Environmental) security protects the Confidentiality, Integrity and Availability  of physical assets: people, buildings, systems, and data. The CISSP® exam considers human safety as the most critical concern of this domain, which trumps all other concerns.

Physical security protects against threats such as unauthorized access and disasters, both man-made and natural. Controls used in this domain are primarily physical (such as locks, fences, guards, etc.); administrative controls (such as policy and procedures) and technical (such as biometrics) are also used.

Physical access control

Physical access control consists of the systems and techniques used to restrict access to a security perimeter and provide boundary protection.

Types of Vehicle Gates :

  • class 1 – residential (home use)
  • class 2 – commercial/general access (parking garage)
  • class 3 – industrial/limited access
  • class 4 – restricted access

A traffic bollard is a strong post designed to stop a car.

Lock picking is the art of opening a lock without a key.

The master key opens any lock for a given security zone in a building.

The core key is used to remove the lock core in interchangeable core locks (where the lock core may be easily removed and replaced with another core).

A smart card is physical access control device which is often used for electronic locks, credit card purchases, or dual-factor authentication systems.

A magnetic stripe card contains a magnetic stripe which stores information.

A mantrap is a preventive physical control with two doors. The first door must close and lock before the second door may be opened. Each door typically requires a separate form of authentication to open.

Turnstiles are designed to prevent tailgating by enforcing a “one person per authentication” rule, just as they do in subway systems.

Technical controls

Technical control include monitoring and surveillance, intrusion detection systems and alarms.

Closed Circuit Television (CCTV) is a detective device used to aid guards in detecting the presence of intruders in restricted areas.Key issues include depth of field (the area that is in focus) and field of view (the entire area viewed by the camera). More light allows a larger depth of field because a smaller aperture places more of the image in focus. CCTV displays may display a fixed camera view, autoscan (show a given camera for a few seconds before moving to the next), or multiplexing (where multiple camera feeds are fed into one display).

Ultrasonic, microwave, and infrared motion sensors are active sensors, which means they actively send energy.

If you see the term “intrusion” on the exam, be sure to look for the context (human or network-based).

Door hinges should face inward, or be otherwise protected. Externally-facing hinges that are not secured pose a security risk: attackers can remove the hinge pins with a hammer and screwdriver, allowing the door to be opened from the hinge side.

Use of simple glass windows in a secure perimeter requires a compensating control such as window burglar alarms.

Environmental and life safety controls

Environmental controls are designed to provide a safe environment for personnel and equipment. Power, HVAC, and fire safety are considered environmental controls.

The following are common types of electrical faults:

  •  Blackout: prolonged loss of power
  • Brownout: prolonged low voltage
  • Fault: short loss of power
  • Surge: prolonged high voltage
  • Spike: temporary high voltage
  • Sag: temporary low

Heat detectors, flame detectors, and smoke detectors provide three methods for detecting fire.

The two primary evacuation roles are safety warden and meeting point leader.

Classes of Fire and Suppression Agents :

  • Class A  – fires are common combustibles such as wood, paper, etc. This type of fire is the most common and should be extinguished with water or soda acid.
  • Class B  – fires are burning alcohol, oil, and other petroleum products such as gasoline. They are extinguished with gas or soda acid. You should never use water to extinguish a class B fire.
  • Class C  – fires are electrical fires which are fed by electricity and may occur in equipment or wiring. Electrical fires are Conductive fires, and the extinguishing agent must be non-Conductive, such as any type of gas.
  • Class D  – fires are burning metals and are extinguished with dry powder.
  • Class K – fires are kitchen fires, such as burning oil or grease. Wet chemicals are used to extinguish class K fires.

Experts always prefer to prevent a fire rather than extinguish one, and are often generous with their time dedicated to preventive measures.

All fire suppression agents work via four methods (sometimes in combination): reducing the temperature of the fire, reducing the supply of oxygen, reducing the supply of fuel, and interfering with the chemical reaction within fire.

Always consider “hire or ask an expert” as a valid choice for any exam question asking about “the best thing to do.” Do not fall for the engineer’s trap of “I will figure this out on my own.”

Water suppresses fire by lowering the temperature below the kindling point (also called the ignition point). Water is the safest of all suppressive agents, and recommended for extinguishing common combustible fires such as burning paper or wood.

In addition to suppressing fire by lowering temperature, soda acid also has additional suppressive properties beyond plain water: it creates foam which can float on the surface of some liquid fires, starving the oxygen supply.

Extinguishing a fire with dry powder (such as sodium chloride) works by lowering temperature and smothering the fire, starving it of oxygen. Dry powder is primarily used to extinguish metal fires.

Wet chemicals are primarily used to extinguish kitchen fires (type K fires in the U.S.; type F in Europe), but may also be used on common combustible fires (type A).

CO2, oxygen, and nitrogen are what we breathe as air. Fires require oxygen as fuel, so fires may be smothered by removing the oxygen: this is how CO2 fire suppression works. A risk associated with CO2 is it is odorless and colorless, and our bodies will breathe it as air. By the time we begin suffocating due to lack of oxygen, it is often too late.

Halon extinguishes fire via a chemical reaction that consumes energy and lowers the temperature of the fire.Halon has ozone-depleting properties. Due to this effect, the 1989 Montreal Protocol (formally called the “Montreal Protocol on Substances That Deplete the Ozone Layer”) banned production and consumption of new halon in developed countries by January 1, 1994.

Recommended replacements for halon include the following systems: • Argon • FE-13 • FM-200

CO2, halon, and halon substitutes such as FM-200 are considered gas-based systems. All gas systems should use a countdown timer (both visible and audible) before gas is released. This is primarily for safety reasons, to allow personnel evacuation before release. A secondary effect is to allow personnel to stop the release in case of false alarm.

Water is usually the recommended fire suppression agent. Water (in the absence of electricity) is the safest suppression agent for people.

Dry pipe systems also have closed sprinkler heads: the difference is the pipes are filled with compressed air. The water is held back by a valve that remains closed as long as sufficient air pressure remains in the pipes. As the dry pipe sprinkler heads open, the air pressure drops in each pipe, allowing the valve to open and send water to that head.

Dry pipes are often used in areas where water may freeze, such as parking garages.

Deluge systems are similar to dry pipes, except the sprinkler heads are open and larger than dry pipe heads. The pipes are empty at normal air pressure; the water is held back by a deluge valve.

(My) CISSP Notes – Cryptography

Note: This notes were made using the following books: “CISPP Study Guide” and “CISSP for dummies”.

Cryptographic concepts

Cryptology is the science of secure communications. Cryptography creates messages whose meaning is hidden; cryptanalysis is the science of breaking encrypted messages (recovering their meaning).

A cipher is a cryptographic algorithm. A plaintext is an unencrypted message.

Cryptography can provide confidentiality (secrets remain secret) and integrity (data is not altered in an unauthorized manner). Cryptography can also provide authentication (proving an identity claim). Additionally, cryptography can provide nonrepudiation, which is an assurance that a specific user performed a specific transaction and that the transaction did not change.

Diffusion means the order of the plaintext should be “diffused” (or dispersed) in the ciphertext. Confusion means that the relationship between the plaintext and ciphertext should be as confused (or random) as possible.

Cryptographic substitution replaces one character for another; this provides diffusion. Permutation (also called transposition) provides confusion by rearranging the characters of the plaintext, anagram-style.

The work factor describes how long it will take to break a cryptosystem (decrypt a ciphertext without the key).

A monoalphabetic cipher uses one alphabet: a specific letter (like “E”) is substituted for another (like “X”). A polyalphabetic cipher uses multiple alphabets: “E” may be substituted for “X” one round, and then “S” the next round.

There are three primary types of modern encryption: symmetric, asymmetric, and hashing.

one-time pad uses identical paired pads of random characters, with a set amount of characters per page.

The one-time pad is the only encryption method that is mathematically proven to be secure, if the following three conditions are met: the characters on the pad are truly random, the pads are kept secure, and no page is ever reused.

The first known use of a one-time pad was the Vernam Cipher, named after Gilbert Vernam, an employee of AT&T Bell Laboratories.

COCOM is the Coordinating Committee for Multilateral Export Controls, which was in effect from 1947 to 1994.

Symmetric encryption

Symmetric encryption uses one key to encrypt and decrypt.

Symmetric encryption may have stream and block modes. Stream mode means each bit is independently encrypted in a “stream.” Block mode ciphers encrypt blocks of data each round.

An initialization vector is used in some symmetric ciphers to ensure that the first encrypted block of data is random. This ensures that identical plaintexts encrypt to different ciphertexts.

Chaining (called feedback in stream modes) seeds the previous encrypted block into the next block to be encrypted.

Symmetric encryption advantages: speed, strength (strength is gained when used with large keys, 128 bits, 256 bits or larger), availability (there are many algorithms available to select and use).

Symmetric encryption disadvantages: keys distribution (secure distribution of the keys is absolutely required), scalability (a different key is required for each pair of communication parties), limited functionality (symmetry systems can’t provide authentication or non-repudiation).

DES (Data Encryption Standard)

DES is a block cypher that uses a 64-bit block size (meaning it encrypts 64 bits each round) and a 56-bit key.

DES can use five different modes to encrypt data. The modes’ primary difference is block versus (emulated) stream, the use of initialization vectors, and whether errors in encryption will propagate to subsequent blocks.

The five modes of DES are:

  • Electronic Code Book (ECB) – is the simplest and weakest form of DES. It uses no initialization vector or chaining. Identical plaintexts with identical keys encrypt to identical ciphertexts.
  • Cipher Block Chaining (CBC) – is a block mode of DES that XORs the previous encrypted block of ciphertext to the next block of plaintext to be encrypted. The first encrypted block is an initialization vector that contains random data. This “chaining” destroys patterns. One limitation of CBC mode is that encryption errors will propagate: an encryption error in one block will cascade through subsequent blocks due to the chaining, destroying their integrity.
  • Cipher Feedback (CFB) – is very similar to CBC; the primary difference is CFB is a stream mode.Errors will not propagate.
  • Output Feedback (OFB) – is also a stream cipher very similar to CFB. In this mode, previous plaintext is used as feedback (chaining) for key generation.
  • Counter Mode (CTR) This mode shares the same advantages as OFB (patterns are destroyed and errors do not propagate) with an additional advantage: since the feedback can be as simple as an ascending number, CTR mode encryption can be done in parallel.

Triple DES

Triple DES applies single DES encryption three times per block.

Triple DES has held up well after years of cryptanalysis; the primary weakness is that it is slow and complex compared to newer symmetric algorithms such as AES or Twofish.

Triple DES applies DES encryption three times per block. FIPS 46-3 describes Encrypt, Decrypt, Encrypt” (EDE) order using three keying options: one, two, or three unique keys (called 1TDES EDE, 2TDES EDE, and 3TDES EDE, respectively).

If you “decrypt” with a different key than the one used to encrypt, you are really encrypting further. Also, EDE with one key allows backwards compatibility with single DES.

2TDES EDE uses key 1 to encrypt, key 2 to “decrypt,” and key 1 to encrypt. This results in 112 bits of key length.

3TDES EDE (three different keys) is the strongest form, with 168 bits of key length.

International Data Encryption Algorithm

The International Data Encryption Algorithm is a symmetric block cipher designed as an international replacement to DES. The IDEA algorithm is patented in many countries. It uses a 128-bit key and 64-bit block size.

Advanced Encryption Standards (AES)

AES was designed to replace DES. Two- and three-key TDES EDE remain a FIPS-approved standard until 2030, to allow transition to AES. Single DES is not a current standard, and not recommended.

AES has four functions:

  • SubBytes –  provides confusion by substituting the bytes of the State. The bytes are substituted according to a substitution table (also called an S-Box).
  • ShiftRows –  provides diffusion by shifting rows of the State.
  • MixColumns – provides diffusion by “mixing” the columns of the State via finite field mathematics,
  • AddRoundKey –  is the final function applied in each round. It XORS the State with the subkey. The subkey is derived from the key, and is different for each round of.

Blowfish and Twofish are symmetric block ciphers created by teams lead by Bruce Schneier,

RC5 and RC6 are symmetric block ciphers by RSA Laboratories.

RC6 was an AES finalist. It is based on RC5, altered to meet the AES requirements.

Asymmetric encryption

Asymmetric encryption uses two keys: if you encrypt with one key, you may decrypt with the other.

The main disadvantage of asymmetric encryption is theirs lower speed.

The main significant advantages of the asymmetric encryptions are extended functionality (can provide both confidentiality and authentication) and scalability (it solves the key management issues associated with symmetric keys systems).

Some mathematical concepts

The asymmetric algorithms uses “one-way functions”. An example of one-way function is factoring a composite number into its primes. Multiplying the prime number 6269 by the prime number 7883 results in the composite number 49 418 527. That “way” it’s easy to compute. Answering the question “which prime number times which prime number equals 49,418,527” is much more difficult. That problem is called factoring, This is the basis of RSA algorithm.

Factoring a large composite number (one thousands of bits long) is so difficult that the composite number can be safely publicly posted (this is the public key).

The primes that are multiplied to create the public key must be kept private (they are the private key).

A logarithm is the opposite of exponentiation. Computing 7 to the 13th power (exponentiation) is easy on a modern calculator: 96,889,010,407. Asking the question “96,889,010,407 is 7 to what power” (finding the logarithm) is more difficult. This is the basis of the Diffie-Hellman algorithm.

Key agreement allows two parties to securely agree on a symmetric key via a public channel, such as the Internet, with no prior key exchange.

Asymmetric and symmetric encryption are typically used together: use an asymmetric algorithm such as RSA to securely send someone an AES (symmetric) key. The symmetric key is called the session key; a new session key may be retransmitted periodically via RSA.

Use the slower and weaker asymmetric system for the one part that symmetric encryption cannot do: securely preshare keys. Once shared, leverage the fast and strong symmetric encryption to encrypt all further traffic.

Hash functions

Hash functions are primarily used to provide integrity: if the hash of a plaintext changes, the plaintext itself has changed.

MD5 creates a 128-bit hash value based on any input length.

MD6 is the newest version of the MD family.

SHA-1 creates a 160-bit hash value.

SHA-2 includes SHA-224, SHA-256, SHA-384, and SHA-512, named after the length of the message digest each creates.

HAVAL uses some of the design principles behind the MD family of hash algorithms, and is faster than MD5.

Cryptographic attacks

Cryptographic attacks are used by cryptanalysts to recover the plaintext without the  key.

  • brute-force attack  – generates the entire keyspace, which is every possible key.
  • known plaintext –  relies on recovering and analyzing a matching plaintext and ciphertext pair: the goal is to derive the key which was used.
  • chosen plaintext and adaptive chosen plaintext– a cryptanalyst chooses the plaintext to be encrypted in a chosen plaintext attack; the goal is to derive the key. Adaptive chosen plaintext begins with a chosen plaintext attack in round 1. The cryptanalyst then “adapts” further rounds of encryption based on the previous round.
  • chosen cipher text and adaptive chosen cipher text -chosen cipher text attacks mirror chosen plaintext attacks: the difference is that the cryptanalyst chooses the cipher text to be decrypted. This attack is usually launched against asymmetric crypto-systems, where the cryptanalyst may choose public documents to decrypt which are signed (encrypted) with a user’s public key.
  • meet-in-the-middle attack – encrypts on one side, decrypts on the other side, and meets in the middle.
  • known key attack – the term “known key attack” is misleading: if the cryptanalyst knows the key, the attack is over. Known key means the cryptanalyst knows something about the key, to reduce the efforts used to attack it. If the cryptanalyst knows that the key is an uppercase letter and a number only, other characters may be omitted in the attack.
  • differential cryptanalysis  – seeks to find the “difference” between related plaintexts that are encrypted.
  • linear cryptanalysis – is a known plaintext attack where the cryptanalyst finds large amounts of plaintext/ciphertext pairs created with the same key.
  • side-channel attacks – use physical data to break a cryptosystem, such as monitoring CPU cycles or power consumption used while encrypting or decrypting.
  • the birthday attack – is used to create hash collisions. Just as matching your birthday is difficult, finding a specific input with a hash that collides with another input is difficult. However, just like matching any birthday is easier, finding any input that creates a colliding hash with any other input is easier due to the birthday attack.
  • key clustering – occurs when two symmetric keys applied to the same plaintext produce the same ciphertext. This allows two different keys to decrypt the ciphertext.

(My) CISSP Notes – Legal, regulations , investigations and compliance

Note: This notes were made using the following books: “CISPP Study Guide” and “CISSP for dummies”.

This chapter will introduce some of the basic concepts that are important to all information security professionals. The actual implementation of laws surrounding intellectual property, privacy, reasonable searches, and breach notification, to name a few, will differ amongst various regions of the world, but the importance of these concepts is still universal.

Major types and classifications of laws

The three major systems of law are:

  • civil – by far the most common of the major legal systems is that of civil law, which is employed by many countries throughout the world. The system of civil law leverages codified laws or statutes to determine what is considered within the bounds of law.
  • common – Common law is the legal system used in the United States, Canada, the United Kingdom, and most former British colonies, amongst others.The primary distinguishing feature of common law is the significant emphasis on particular cases and judicial precedents as determinants of laws.
  • religious – religious law serves as the third of the major legal systems. Religious doctrine or interpretation serves as a source of legal understanding and statutes. However, the extent and degree to which religious texts, practices, or understanding are consulted can vary greatly.

The most significant difference between civil and common law is that, under civil law, judicial precedents and particular case rulings do not carry the weight they do under common law.

Within common law there are various branches of laws:

  • criminal law – pertains to those laws where the victim can be seen as society itself. The goals of criminal law are to deter crime and to punish offenders.
  • civil law -Another term associated with civil law is tort law, which deals with injury, loosely defined, that results from someone violating their responsibility to provide a duty of care. Tort law is the primary component of civil law, and is the most significant source of lawsuits seeking damages.While, in criminal law, society is seen as the victim, in civil law the victim will be an individual, group, organization.Another difference between criminal and civil law is the goal of each. The focus of criminal law is punishment and deterrence; civil law focuses on compensating the victim.The most common outcome of a successful ruling against a defendant is requiring the payment of financial damages.
  • administrative law – Administrative law or regulatory law is law enacted by government agencies.Some examples of administrative law are FCC regulations, HIPAA Security mandates, FDA regulations, and FAA regulations.

Types of laws relevant to computer crimes

One of the most difficult aspects of prosecution of computer crimes is attribution. Meeting the burden of proof requirement in criminal proceedings, beyond a reasonable doubt, can be difficult given an attacker can often spoof the source of the crime or can leverage different systems under someone else’s control.

Intellectual property

Intelectual property is protected by the U.S law under one of four classifications:

  • patents – Patents provide a monopoly to the patent holder on the right to use, make, or sell an invention for a period of time in exchange for the patent holder’s making the invention public.
  • trademarks – Trademarks are associated with marketing: the purpose is to allow for the creation of a brand that distinguishes the source of products or services.
  • copyrights – represents a type of intellectual property that protects the form of expression in artistic, musical, or literary works, and is typically denoted by the circle c symbol. Software is typically covered by copyright as if it were a literary work. Two important limitations on the exclusivity of the copyright holder’s monopoly exist: the doctrines of first sale and fair use. The first sale doctrine allows a legitimate purchaser of copyrighted material to sell it to another person. If the purchasers of a CD later decide that they no longer cared to own the CD, the first sale doctrine gives them the legal right to sell the copyrighted material even though they are not the copyright holders.
  • trade secrets – business-proprietary information that is important to an organization’s ability to compete. Software source code or firmware code are examples of computer-related objects that an organization may protect as trade secrets.

Privacy and data protection laws

Privacy and data protection laws are enacted to protect information collected and maintained on individuals from unauthorized disclosure or misuse.

Several important pieces of privacy and data protection legislation include :

Associated with personal data privacy concerns are the recent development of breach notification laws. The push for mandatory notification of persons whose personal data has been, or is likely to have been, compromised started with state laws.

Legal liability is another important legal concept for information security professionals and their employers. Society has grown quite litigious over the years, and the question of whether an organization is legally liable for specific actions or inactions can prove costly.

Two important terms to understand are due care and due diligence, which have become common standards that are used in determining corporate liability in courts of law.

The standard of due care, or a duty of care, provides a framework that helps to define a minimum standard of protection that business stakeholders must attempt to achieve.

Due care discussions often reference the Prudent Man Rule, and require that the organization engage in business practices that a prudent, right thinking, person would consider to be appropriate.

A concept closely related to due care is due diligence. While due care intends to set a minimum necessary standard of care to be employed by an organization, due diligence requires that an organization continually scrutinize their own practices to ensure that they are always meeting or exceeding the requirements for protection of assets and stakeholders. Due diligence is the management of due care: it follows a formal process.

Computer crime and information security laws

Legal aspects of investigations

Digital forensics

Digital forensics provides a formal approach to dealing with investigations and evidence with special consideration of the legal aspects of this process.

The main distinction between forensics and incident response is that forensics is evidence-centric and typically more closely associated with crimes, while incident response is more dedicated to identifying, containing, and recovering from security incidents.

The forensic process must preserve the “crime scene” and the evidence in order to prevent unintentionally violating the integrity of either the data or the data’s environment. A primary goal of forensics is to prevent unintentional modification of the system.

Anti-forensics makes forensic investigation difficult or impossible.

The general phases of the forensic process are: the identification of potential evidence; the acquisition of that evidence; analysis of the evidence; and finally production of a report.

While forensics investigators traditionally removed power from a system, the typical approach now is to gather volatile data. Acquiring volatile data is called live forensics, as opposed to the post-mortem forensics associated with acquiring a binary disk image from a powered down system.


Evidence is one of the most important legal concepts for information security professionals to understand.

Evidence should be relevant, authentic, accurate, complete, and convincing. Evidence gathering should emphasize these criteria.

  • Real (or physical) evidence  – consists of tangible or physical objects.
  • Direct evidence  – is testimony provided by a witness regarding what the witness actually experienced with her five senses.
  • Circumstantial evidence –  is evidence which serves to establish the circumstances related to particular points or even other evidence.In order to strengthen a particular fact or element of a case there might be a need for corroborative evidence. This type of evidence provides additional support for a fact that might have been called into question.
  • Hearsay evidence – constitutes second-hand evidence. As opposed to direct evidence, which someone has witnessed with her five senses, hearsay evidence involves indirect information.Business and computer generated records are generally considered hearsay evidence, but case law and updates to the Federal Rules of Evidence have established exceptions to the general rule of business records and computer generated data and logs being hearsay.

Courts prefer the best evidence possible. Original documents are preferred over copies: conclusive tangible objects are preferred over oral testimony. Recall that the five desirable criteria for evidence suggest that, where possible, evidence should be: relevant, authentic, accurate, complete, and convincing.

Secondary evidence is a class of evidence common in cases involving computers. Secondary evidence consists of copies of original documents and oral descriptions.

Computer-generated logs and documents might also constitute secondary rather than best evidence.

Evidence must be reliable. It is common during forensic and incident response investigations to analyze digital media. It is critical to maintain the integrity of the data during the course of its acquisition and analysis. Checksums can ensure that no data changes occurred as a result of the acquisition and analysis.

In addition to the use of integrity hashing algorithms and checksums, another means to help express the reliability of evidence is by maintaining chain of custody documentation. Chain of custody requires that once evidence is acquired, full documentation regarding who, what, and when and where evidence was handled is maintained.

Entrapment is when law enforcement, or an agent of law enforcement, persuades someone to commit a crime when the person otherwise had no intention to commit a crime. Entrapment can serve as a legal defense in a court of law, and, therefore, should be avoided if prosecution is a goal.

A closely related concept is enticement. Enticement could still involve agents of law enforcement making the conditions for commission of a crime favorable, but the difference is that the person is determined to have already broken a law or is intent on doing so.

Professional ethics

Ethics help to describe what you should do in a given situation based on a set of principles or values.

ISC2 Code of ethics contains 4 mandatory canons:

  1. protect society, the commonwealth and the infrastructure.
  2. act honorably, honestly, justly, responsibly and legally.
  3. provide diligent and competent service to principals.
  4. advance and protect the profession.