CISSP Practice question #2

In software development security should be:
A: Added on later.
B: Added when we are compromised.
C: Designed into the software.
D: Added only in important areas.

CBK 8: Software Development Security
Source: ThorTeaches.com practice tests

Answer


C: Security should be designed into the software and be part of the initial requirements just as functionality is. The more breaches and compromises more we see the move towards security being part of the scope of the software design project. We use software, at our jobs, our personal lives, our homes, cars, power, water … It is everywhere and it has been and still is common to write functional code, security is an afterthought or not considered at all.

show less

IT security trainer.
Sharing my knowledge, to help you reach your IT certification goals.
CISSP, C|EH, PMP, CCNP, CompTIA Security+, SCP, CCNA-Security, CCNA, et. Al.

Continue Reading

National Cyber Security Awareness Month – Stay Safe Online

National Cyber Security Awareness Month – Stay Safe Online

Each and every one of us needs to do our part to make sure that our online lives are kept safe and secure. That’s what National Cyber Security Awareness Month (NCSAM) – observed in October – is all about!

Source: staysafeonline.org/ncsam/

IT security trainer.
Sharing my knowledge, to help you reach your IT certification goals.
CISSP, C|EH, PMP, CCNP, CompTIA Security+, SCP, CCNA-Security, CCNA, et. Al.

Continue Reading

CISSP certification: Need to know and least privilege.

Most large organizations use role based access control, your access levels are determined by your job role. 

Even if you have access to the data you may not be allowed to access it unless required by what you are working on, this is called need to know.

  • Need to know:
    • Just because you have access does not mean you are allowed the data.
    • You need a valid reason for accessing the data. If you do not have one you can be terminated/sued/jailed/fined.
    • Leaked information about Octomom Natalie Suleman cost 15 Kaiser employees fines or terminations, they had no valid reason for accessing her file.
      • We may never know who actually leaked the information. It may not be one of the 15, but they violated HIPAA by accessing the data without a need to know.

Another approach is giving employees as little as possible access, just enough for them to do their job.

  • Least privilege:
    • Users have the minimum necessary access to perform their job duties.

IT security trainer.
Sharing my knowledge, to help you reach your IT certification goals.
CISSP, C|EH, PMP, CCNP, CompTIA Security+, SCP, CCNA-Security, CCNA, et. Al.

Continue Reading

CISSP Certification: Competition time – Win a CISSP practice test!

Competition time!

Enter to win a free CISSP Practice exam.

Rules:

To enter you must do all these 3 to be eligible (+3 entries).

  1. Join my Facebook group
  2. Join our free member page, make sure your FB and member page name match.
  3. Like and comment on this post in the Facebook group.

Optional: 
1. Share the Facebook group post on your Facebook wall (+5 entries).

The Winner will be drawn at random after the competition is over and announced in the Facebook group!
If you already own all 4 practice tests, we can do a amazon gift card instead, but this only available to people with all 4 tests.
The competition ends October 8th at 12:00 HST (noon).

IT security trainer.
Sharing my knowledge, to help you reach your IT certification goals.
CISSP, C|EH, PMP, CCNP, CompTIA Security+, SCP, CCNA-Security, CCNA, et. Al.

Continue Reading

CISSP Practice question #1

A smoke photoelectric detector detects what?
A: The infrared light emitted from a fire.
B: A change in the light indicating higher particle density.
C: A rise in temperature indicating a fire.
D: If the light is off in the data center.

CBK 3: Security Engineering
Source: ThorTeaches.com practice tests

Answer


B: Smoke Detectors: Photoelectric uses LED (Light Emitting Diode) and a photoelectric sensor that produces a small charge while receiving light. Triggers when smoke or any higher particle density interrupts the light.

show less

IT security trainer.
Sharing my knowledge, to help you reach your IT certification goals.
CISSP, C|EH, PMP, CCNP, CompTIA Security+, SCP, CCNA-Security, CCNA, et. Al.

Continue Reading

CISSP Certification – from (ISC)² “Three Reasons Why Cybersecurity Certifications are Essential”

Three Reasons Why Cybersecurity Certifications are Essential

Other than a college degree, how can you validate your knowledge and skills? Certifications represent a way for professionals to validate their knowledge and expertise, as well as a path for continued education and professional development. But what about value? Why are cybersecurity certifications essential today? What is the value of a cybersecurity certification? Proves Your Worth According to the 2017 (ISC)² Global Information Security Workforce Study (GISWS), when respondents were asked for the reasons why their organization requires staff to have information security certifications, employee competence was the most common answer. You can spend years working to prove your…

Source: blog.isc2.org/isc2_blog/2017/05/three-reasons-cybersecurity-certifications-essential.html

IT security trainer.
Sharing my knowledge, to help you reach your IT certification goals.
CISSP, C|EH, PMP, CCNP, CompTIA Security+, SCP, CCNA-Security, CCNA, et. Al.

Continue Reading

CISSP certification: Data disposal.

Data Destruction:

When we no longer need a certain media, we must dispose of it in a manner that ensures the data can’t be retrieved. This pertains to both electronic media and paper copies of data.

  • Paper disposal.
    • It is highly encouraged to dispose of ANY paper with any data on it in a secure manner.
    • This also has standards and cross shredding is recommended.
    • It is easy to scan and have a program re-assemble documents from normal shreds like the this one.
  • Digital disposal – The digital disposal procedures are determined by the type of media.
    • Deleting, Formatting and Overwriting (Soft destruction):
      • Deleting a file just removes it from the table; everything is still recoverable.
      • Formatting does the same but it also puts a new file structure over the old one. Still recoverable in most cases.
      • Overwriting is done by writing 0’s or random characters over the data.
        • As far as we know there is no tool available that can recover even single pass overwriting (not possible on damaged media).
    • Degaussing destroys magnetic media by exposing it to a very strong magnetic field.
      • This will also most likely destroy the media integrity.
    • Full physical destruction is safer than soft destruction:
      • Disk Crushers do exactly what their name implies: they crush disks (often used on spinning disks).
      • Shredders do the same thing as paper shredders do, they just work on metal.
        • These are rare to have at normal organizations, but you can buy the service.
      • Incineration, pulverizing, melting and acid are also (very rarely) used to ensure full data destruction.
  • It is common to do multiple types of data destruction on sensitive data (both degaussing and disk crushing/shredding).
  • While it may not be necessary, it is a lot cheaper than a potential $1,000,000 fine or loss of proprietary technology or state secrets.

IT security trainer.
Sharing my knowledge, to help you reach your IT certification goals.
CISSP, C|EH, PMP, CCNP, CompTIA Security+, SCP, CCNA-Security, CCNA, et. Al.

Continue Reading

IT Security – from (ISC)² “Continuing the Conversation: Spearphishing”

Continuing the Conversation: Spearphishing

If you’ve attended any of our (ISC)² ThinkTank Webinars (and we hope you have!) you know that moderator Brandon Dunlap shares your questions with panelists to answer during the session. While we can’t get to all questions, we’d like to address a few more here on our blog. Last week’s webinar was “The Human Target – The Tip of the Spear is Aimed at You”, with panelists Ira Winkler, president of Secret Mentem, Sylvester Gray, security product specialist at Sophos and Johnny Deutsch, senior manager, advanced security center at Ernst & Young, LLP. Thank you to our panelists for sharing…

Source: blog.isc2.org/isc2_blog/2017/06/continuing-the-conversation-spearphishing.html

IT security trainer.
Sharing my knowledge, to help you reach your IT certification goals.
CISSP, C|EH, PMP, CCNP, CompTIA Security+, SCP, CCNA-Security, CCNA, et. Al.

Continue Reading

CISSP certification: ROM and RAM.

  • Memory: Is just 0’s (off) and 1’s (on); switches representing bits.
    • Cache Memory: Closest to the CPU, Fastest, L1 Cache is on the CPU, L2 Cache is connected to CPU but outside it.
      • ROM (Read Only Memory) is nonvolatile (retains memory after power loss); most common use is the BIOS.
        • PROM (Programmable Read Only Memory):
          • Can only be written once, normally at the factory.
        • EPROM (Erasable Programmable Read Only Memory):
          • Can be erased (flashed) and written many times, by shining an ultraviolet light (flash) on a small window on the chip (normally covered by foil).
        • EEPROM (Electrically Erasable Programmable Read Only Memory):
          • These are Electrically Erasable, you can use a flashing program. This is still called Read Only.
          • The ability to write to the BIOS makes it vulnerable to attackers.
        • PLD (Programmable Logic Devices) are programmable after they leave the factory (EPROM, EEPROM and Flash Memory). Not PROM.
          • RAM (Random Access Memory) is volatile memory.
            • It loses the memory content after a power loss(or within a few minutes).
            • This can be memory sticks or embedded memory.
            • SRAM and DRAM:
              • SRAM (Static RAM): Fast and Expensive.
                • Uses latches to store bits (Flip-Flops).
                • Does not need refreshing to keep data, keeps data until power is lost.
                • This can be embedded on the CPU.
              • DRAM (Dynamic RAM) Slower and Cheaper.
                • Uses small capacitors. Must be refreshed to keep data integrity (100-1000ms).
                • This can be embedded on graphics cards.
              • SDRAM: (Synchronous DRAM):
                • What we normally put in the motherboard slots for the memory sticks.
                • Most common now is DDR (Double Data Rate) 1, 2, 3, 4 SDRAM.

IT security trainer.
Sharing my knowledge, to help you reach your IT certification goals.
CISSP, C|EH, PMP, CCNP, CompTIA Security+, SCP, CCNA-Security, CCNA, et. Al.

Continue Reading

CISSP certification: Data, system, mission ownership, custodians and users.

Data, System, Mission Ownership, Custodians and Users:

Each role has unique roles and responsibilities to keep the data safe.

  • Mission/Business Owner:
    • Senior executives make the policies that govern our data security.
  • Data/Information Owner:
    • Management level, they assign sensitivity labels and backup frequency.
    • This could be you or a Data Owner from HR, Payroll or other departments.
  • System Owner:
    • Management level and the owner of the systems that house the data.
    • Often a Data Center Manager or an Infrastructure Manager.
  • Data Custodian:
    • These are the technical hands-on employees who do the backups, restores, patches, system configuration.
    • They follow the directions of the Data Owner.
  • Users:
    • These are the users of the data.
    • User awareness must be trained; they need to know what is acceptable and what is not acceptable, and the consequences for not following the policies, procedures and standards.
  • Data Controllers and Data Processors:
    • Controllers create and manage sensitive data in the organization (HR/Payroll)
    • Processors manage the data for Controllers (Outsourced Payroll)

IT security trainer.
Sharing my knowledge, to help you reach your IT certification goals.
CISSP, C|EH, PMP, CCNP, CompTIA Security+, SCP, CCNA-Security, CCNA, et. Al.

Continue Reading