CISA串讲_XXXX[1][1]11

ContinuousControlsMonitoring2010CISAGo-through2010CISAREVIEW2010CISAREVIEWMovetoNextLevelMovetoNextLevelZhaoYangWangCISSP,CISA,PMP2Outlinesƒ章节重点内容ƒ重要专题ƒ重要概念ƒ必考知识点ƒ考试注意事项ƒ附录3章节重点内容–ITServiceDelivery&Support„ITSM„Changemanagement„Programlibrarymanagementsystem4章节重点内容–ITServiceDelivery&Support„Hardwaremaintenance&monitoring„Releasemanagement„Capacitymanagement5章节重点内容–ITServiceDelivery&Support„Database„Utilityprogram„Softwarelicense6章节重点内容–ITServiceDelivery&Support„Network–OSI,TCP/IP–Lanmedia–Lantopology–Landevices–wanmessagetransmissiontechniques–wanmultiplexing–VPN–wireless7章节重点内容–ITServiceDelivery&Support„Publicglobalinternetinfrastructure„Networkmanagement„Middleware&component-oriented8章节重点内容–ProtectionofInformationAssets„importanceofinformationsecuritymanagement–Goal–Elements–roles&responsibilities9章节重点内容–ProtectionofInformationAssets„importanceofinformationsecuritymanagement–inventory&classification–layeredsystemaccesspermission–MACvs.DAC10章节重点内容–ProtectionofInformationAssets„importanceofinformationsecuritymanagement–Privacy–HR&security–Computercrime11章节重点内容–ProtectionofInformationAssets„logicalaccessexposureandcontrols–trojanhorse,virus,worm–backdoor,trapdoor–roundingdown,salamitechnique–socialengineering12章节重点内容–ProtectionofInformationAssets„logicalaccessexposureandcontrols–I&A(somethingyouknow/have/are)–secureID&password–twofactorauthenticationtechnique–SSO13章节重点内容–ProtectionofInformationAssets„logicalaccessexposureandcontrols–biometrics–authorizationissues„centralizedenvironment„decentralizedenvironment„mobilepopularity„accessrighttosystemlogs„BLP,systemexit,specialuserID14章节重点内容–ProtectionofInformationAssets„Networkinfrastructuresecurity–Lanrisk&issues–dial-upaccesscontrols–C/Ssecurity&controls15章节重点内容–ProtectionofInformationAssets„Networkinfrastructuresecurity–wirelesssecurity&controls–internetsecurity&controls–Firewall–IDS–honeynet,honeyport16章节重点内容–ProtectionofInformationAssets„Networkinfrastructuresecurity–Encryption–PKI–virus17章节重点内容–ProtectionofInformationAssets„Networkinfrastructuresecurity–VoIP–PBX18章节重点内容–ProtectionofInformationAssets„Auditingnetworkinfrastructuresecurity–penetrationtest–computerforensic19章节重点内容–ProtectionofInformationAssets„Environmentalexposuresandcontrols–powerfailureandcountermeasures–auditingenvironmentalcontrols20章节重点内容–ProtectionofInformationAssets„Physicalaccessexposuresandcontrols–physicalaccessissuesandexposures–Controls–auditingphysicalaccess–mobilecomputingcontrols21章节重点内容–BCP&DRP„ConceptofBCP/DRP–Purpose–Responsibility–first2steps–goodBCP.22章节重点内容–BCP&DRP„BIA–3issues(process,information,recoverytime)–determinationofrecoverytime–riskranking23章节重点内容–BCP&DRP„RPO&RTO„RecoveryStrategies–recoveryalternatives24章节重点内容–BCP&DRP„Organization&assignmentofresponsibilities–transportationteam–relocationteam25章节重点内容–BCP&DRP„ComponentsofBCP–keydecisionmakingpersonnel&calltree–backupofrequiredsuppliers–networkdisasterrecoverymethods–RAID–insurance26章节重点内容–BCP&DRP„Plantesting–desk-basedevaluation/papertest–preparednesstest–fulloperationaltest27章节重点内容–BCP&DRP„Planmaintenance–review–update–train–test28章节重点内容–BCP&DRP„Backupandrestoration–offsitelibrarycontrols–offsitefacilitiescontrols–offsitemedia&documentscontrols–backup29章节重点内容–BCP&DRP„AuditingDRP/BCP–reviewDRP/BCP–evaluationofpriortestresults–evaluationofoff-sitestorage/facilities/–interviewkeypersonnel–reviewcontractandinsurancecoverage30重要专题-1„Database–DD,DS,DBMS–Integrity–Normalization–Accesscontrol–Portability31重要专题-2„Network–Protocol–Device–Media–Networktype–NetworkTopologies–Messagetransmissiontechniques–Multiplex（TDM,ATDM,FDM,）–Wireless（protocol,risk&controls）32重要专题-3„Encryption–Privatekey,publickey–ECC,QC–Digest,signature–Digitalenvelope–Encryptionalgorithm33重要专题-4„Exposures&Attack–Wiretapping–Malware–Logicbomb–DOS–Wardriving–Piggybacking–Trapdoor–Asynchronousattack–Phishing–Man-in-the-middle–Bruteforce,passwordguessing,call-forwarding34重要专题-5„firewall/IDS/IPS/AAA–Firewalltypes–Firewallsystems–Firewallissues–IDStypes–IDSlimitations–IDSvs.IPS35重要专题-6„RAID–Stripping–Mirroring–Parity–RAID0–RAID1–RAID5–RAID1+036重要专题-7„PKI–Digitalcertificates–CA–RA–CPS–CRL–Distinguishedusername,publickey,thealgorithm,validityperiod,signature–Man-in-the-middle37重要专题-8„Biometrics–FRR,RAR,EER–Socialacceptance–Securityissues(collection,distribution,processing)–Palm,handgeometry,iris,retina,fingerprint,face–Signature,voice38重要专题-9„Risk–vulnerability,threat,risk–inherent,control,detection,audit–qualitative,quantitative,semi-quantitative–Auditrisk(inherent,control,detection,overall)–Samplingrisk–Secondaryrisk–Avoid,mitigate,transfer,accept,Eliminate–Utilitytheory-Reducerisktoanacceptablelevel39重要概念-1„Accountability/Auditability/Traceability„Effectivevs.Efficient„Owner,user,administrator.40重要概念-2„DDvs.DS„Compliancevs.Substantivetesting„QCvs.QA41重要概念-3„Integrity,ACCA,ACID„RPOvs.RTO„Changemanagement,Configurationmanagement,baseline,version/release42重要概念-4„Baselinevs.benchmark(plan,research,observe,analyze,adapt,improve)„Problemvs.incident„Authentication