| Introduction |
|
xi | |
| DOMAIN 1 ACCESS CONTROL SYSTEMS AND METHODOLOGY |
|
1 | (50) |
| Section 1.1 Access Control Issues |
|
|
|
|
5 | (28) |
|
|
|
|
|
| Section 1.2 Access Control Administration |
|
|
Centralized Authentication Services (Radius, Tacacs, Diameter) |
|
|
33 | (18) |
|
|
|
|
|
| DOMAIN 2 TELECOMMUNICATIONS AND NETWORK SECURITY |
|
51 | (146) |
| Section 2.1 Network Security |
|
|
|
|
55 | (28) |
|
|
|
|
|
|
Integrity and Security of ATM |
|
|
83 | (16) |
|
|
|
|
|
|
An Introduction to Secure Remote Access |
|
|
99 | (18) |
|
|
|
|
|
|
Packet Sniffers and Network Monitors |
|
|
117 | (30) |
|
|
|
|
|
|
|
|
|
|
| Section 2.2 Internet, Intranet, and Extranet Security |
|
|
Enclaves: The Enterprise as an Extranet |
|
|
147 | (14) |
|
|
|
|
|
|
IPSec Virtual Private Networks |
|
|
161 | (36) |
|
|
|
|
|
| DOMAIN 3 SECURITY MANAGEMENT PRACTICES |
|
197 | (52) |
| Section 3.1 Security Awareness |
|
|
|
|
201 | (20) |
|
|
|
|
|
| Section 3.2 Policies, Standards, Procedures, and Guidelines |
|
|
The Building Blocks of Information Security |
|
|
221 | (20) |
|
|
|
|
|
| Section 3.3 Risk Management |
|
|
The Business Case for Information Security: Selling Management on the Protection of Vital Secrets and Products |
|
|
241 | (8) |
|
|
|
|
|
| DOMAIN 4 APPLICATIONS AND SYSTEMS DEVELOPMENT SECURITY |
|
249 | (108) |
| Section 4.1 Application Security |
|
|
|
|
253 | (18) |
|
|
|
|
|
|
World Wide Web Application Security |
|
|
271 | (20) |
|
|
|
|
|
|
Common System Design Flaws and Security Issues |
|
|
291 | (14) |
|
|
|
|
|
| Section 4.2 System Security |
|
|
Data Marts and Data Warehouses: Keys to the Future or Keys to the Kingdom? |
|
|
305 | (30) |
|
|
|
|
|
|
|
|
|
|
|
Mitigating E-business Security Risks: Public Key Infrastructures in the Real World |
|
|
335 | (22) |
|
|
|
|
|
|
|
|
|
|
| DOMAIN 5 CRYPTOGRAPHY |
|
357 | (78) |
| Section 5.1 Crypto Technology and Implementations |
|
|
Introduction to Encryption |
|
|
361 | (18) |
|
|
|
|
|
|
Three New Models for the Application of Cryptography |
|
|
379 | (16) |
|
|
|
|
|
|
Methods of Attacking and Defending Cryptosystems |
|
|
395 | (20) |
|
|
|
|
|
|
|
|
415 | (20) |
|
|
|
|
|
| DOMAIN 6 SECURITY ARCHITECTURE AND MODELS |
|
435 | (14) |
| Section 6.1 System Architecture and Design |
|
|
Introduction to UNIX Security for Security Practitioners |
|
|
439 | (10) |
|
|
|
|
|
| DOMAIN 7 OPERATIONS SECURITY |
|
449 | (48) |
| Section 7.1 Threats |
|
|
Hacker Tools and Techniques |
|
|
453 | (22) |
|
|
|
|
|
|
An Introduction to Hostile Code and Its Control |
|
|
475 | (22) |
|
|
|
|
|
| DOMAIN 8 BUSINESS CONTINUITY PLANNING AND DISASTER RECOVERY PLANNING |
|
497 | (26) |
| Section 8.1 Business Continuity Planning |
|
|
The Business Impact Assessment Process |
|
|
501 | (22) |
|
|
|
|
|
| DOMAIN 9 LAW, INVESTIGATION, AND ETHICS |
|
523 | (84) |
| Section 9.1 Investigation |
|
|
Computer Crime Investigations: Managing a Process Without Any Golden Rules |
|
|
527 | (22) |
|
|
|
|
|
|
CIRT: Responding to Attack |
|
|
549 | (20) |
|
|
|
|
|
|
Improving Network Level Security Through Real-Time Monitoring and Intrusion Detection |
|
|
569 | (28) |
|
|
|
|
|
|
|
|
597 | (10) |
|
|
|
|
|
| Index |
|
607 | |