CISSP CBK 8 Legal, Regulations, Compliance, and Investigations

Legal, Regulations, Compliance, and Investigations

Council of Europe (CoE) Convention on Cybe rcrime:
If the organization is exchanging data with European entities, it may need to adhere to the Safe harbor

safe harbor framework how any entity that is going to move Private data to and from Europe must provide protection

Civil law deals with wrongs against individuals or companies that result in damages or loss. This is referred to as tort law. no Jail sentence

Criminal law when an individuals conduct violates the government laws / Jail sentence

Administrative/regulatory law deals with regulatory standards that regulate performance and conduct

Intellectual property laws do not necessarily look at who is right or wrong, but rather how a company can protect what it rightfully owns from unauthorized duplication or use,

Trade Secret = competitive value or advantage (formula for Drink)
Copyright= rights for authors(unauthorized copying and distribution of a work)
Trademark= protect a word,name, symbol (identifiable packaging, “trade dress.”)
Patent= (usually valid for 20 years from the date of approval)

international trademark law efforts and international registration are overseen by the World Intellectual Property Organization (WIPO), an agency of the United Nations

Similar to trademarks, international patents are overseen by the WIPO

Digital Millennium Copyright Act (DMCA), which makes it illegal to create products that circumvent copyright protection mechanisms.

Federal Privacy Act of 1974, it has enacted new laws, Gramm-Leach-Bliley Act of 1999


Federal Privacy Act If an agency collects data on a person, that person has the right to receive a report outlining data collected about him if it is requested ialso gives individuals the right to review records about themselves, to find out if these records have been disclosed, and to request corrections or amendments of these records)

Sarbanes-Oxley Act (SOX) law governs accounting practices,
Health Insurance Portability and Accountability Act (HIPAA)

Gramm-Leach-Bliley Act of 1999 (GLBA) requires financial institutions to develop privacy notices and give their customers option to share the data with other companies.

1994 U.S. Communications Assistance for Law Enforcement Act all communications carriers to make wiretaps possible

Computer Fraud and Abuse Act,1986, 1996

• access to federal Govt computers to access classified info
• access to financial institution computers or any computer
• unauthorised access to Govt computer
• knowing access of a protected computer without authorization with intend to Fraud
• causing the transmission of Program/ Information and Code from a computer without owners authorization
• trafficking of computer password for fraud
• transmission of communication containing threats

The Federal Privacy Act of 1974
Government agencies can maintain personnel information only if it is necessary to accomplish the agency’s purpose.

The Privacy Act dictates that an agency cannot disclose this information without written Permission from the individual however there are some exceptions.

1996 U.S Economic and Protection of Proprietary Information Act Industrial and corporate Espionage

1980 Organization for Economic Cooperation and Development (OECD) Guidelines
Deals with data collection limitations, the quality of data, specifications of the purpose for data collection, limitations of data use, participation by the individual on whom the data is being collected, and accountability of the data controller

Basel II
how much capital banks need to put aside to guard against the types of financial and operational risks banks face

1987 U.S. Computer Security Act federal government agencies to conduct security-related training, to identify sensitive systems, and to develop a security plan for those sensitive systems

Computer Security Act of 1987 identify computers with sensitive information.

American citizens are protected by the Fourth Amendment against unlawful search and seizure

Payment Card Industry Data Security Standards (PCI DSS)
any entity that processes, transmits, stores, or accepts credit card data PCI DSS is a private-sector industry initiative. It is not a law and failure to comply may lead to revocation of merchant status or a fine
PCI DSS main areas

• Build and Maintain a Secure Network,
• Protect Cardholder Data,
• Maintain a Vulnerability Management Program,
• Implement Strong Access Control Measures,
• Regularly Monitor and Test Networks,
• Maintain an Information Security Policy

Economic Espionage Act of 1996

1991, U.S. Federal Sentencing Guidelines were developed to provide judges with courses of action in dealing with white collar crimes max fine up to 290 Million $

Employee Privacy Issues
manager can listen your conversation with customer but not your personal conversation

Government regulations SOX, HIPAA, GLBA, BASEL
Self-regulation Payment Card Industry (PCI)
Individual user Passwords, encryption, awareness

Downstream liability when two companies work to gather they must ensure proper protection for each other so if virus effect one company other wil get effected and will finally Sue upstream company.

event is a negative occurrence that can be observed, verified, and documented, whereas an incident is a series of events that negatively affects the company and/or impacts its security posture.

incident response policy should be managed by Legal Department

Three types of incident response team
virtual team members have other jobs slower response
permanent team which is dedicated strictly to incident response
hybrid team some are permanent members and some are called when needed

Main goal of incident handling is to contain and mitigate any damage caused by an incident and to prevent any further damage.

Steps to Incident Responce
Triage : initial screening of the reported event either it is False positive
Investigation:- proper collection of relevant data
Containment:
Analysis:
Tracking:
Recovery:

honeypots can introduce liability issues and be used to attack other internal targets

Steps of Forensic Investigation
Identification
Preservation
Collection
Examination
Analysis
Presentation
Decision

exigent circumstances when law enforcement quickly seize the evidents to avoid destruction for some one

Most of the time, computer-related documents are considered hearsay, meaning the evidence is secondhand evidence

The life cycle of evidence includes
Collection and identification
Storage, preservation, and transportation
Presentation in court
Return of the evidence to the victim or owner

Oral evidence is not considered best evidence because there is no firsthand reliable proof

evidence should be authentic , complete , sufficient and reliable

Dumpster diving is unethical, but it’s not illegal.
Trespassing is illegal,
Emanation = Tempest

Some things may not be illegal, but that does not necessarily mean they are ethical

Red box simulated the tones of coins being deposited into a pay phone
Black Box method to manipulate line voltage to enable people to call toll-free lines.
Blue Box ' that enabled people to make free long-distance phone calls,

Generally Accepted System Security Principles (GASSP) are security-oriented principles and do not specifically cover viruses or worms

ISC2 Code of Ethics

Code of Ethics Preamble:

• Safety of the commonwealth, duty to our principals, and to each other requires that we adhere, and be seen to adhere, to the highest ethical standards of behavior.
• Therefore, strict adherence to this Code is a condition of certification.

Code of Ethics Canons:

• Protect society, the commonwealth, and the infrastructure.
• Act honorably, honestly, justly, responsibly, and legally.
• Provide diligent and competent service to principals.
• Advance and protect the profession

Business attack = competitive intelligence to get trade secret
Intelligence attack = Military
Financing Attack = Bank Fraud

Corroborative Evidence supporting evidence is used to help prove an idea or a point, however It cannot stand on its own i.e Torn clothes, 911 call recording

computer fraudsters hold a position of trust

exclusionary rule mentions that evidence must be gathered legally

incident handling Contain and repair any damage caused by an event

Memory Dump gives an State of the Machine.

Circumstantial evidence = inference of information from other, intermediate, relevant facts. Secondary evidence = copy of evidence or oral description
Conclusive evidence = overrides all other evidence

GIASP Generally Accepted Information Security Principles
Computer security supports the mission of the organization
Computer security is an integral element of sound management
Computer security should be cost-effective
Systems owners have security responsibilities outside their own organization
Computer security responsibilities and accountability should be made explicit
Computer security requires a comprehensive and integrated approach
Computer security should be periodically reassessed
Computer security is constrained by societal factors

CISSP CBK 5 Physical Security

Physical Security

Crime Prevention Through Environmental Design (CPTED) is a discipline that outlines how the proper design of a physical environment can reduce crime by directly affecting human behavior

Soda acid removes fuel from the fire by discharging a thick form that moves the fire away from the fuel supply.
Carbon dioxide removes oxygen from the fire.
Water reduces fire temperature.
Halon (gas) or its substitutes interferes with the chemical reactions between elements in the fire.
clapper valve hold the water back in Dray pipe

Auxiliary station alarms automatically cause an alarm originating in a data center to be transmitted over the local municipal fire or police alarm circuits for relaying to both the local police/fire station and the appropriate headquarters
auditing is a technical control auditing as a audit logs

static charge of 1500 volts is able to cause disk drive data loss.
A charge of 1000 volts is likely to scramble monitor display and a charge of 2000 volts can cause a system shutdown.
It should be noted that charges of up to 20,000 volts or more are possible under conditions of very low humidity with non-static-free carpeting.

The preaction system combines both the dry and wet pipe systems,is most recommended in Comms room . though it is WATER point to remember.

The organization may also have to comply with requirements of the Occupational Safety and Health Administration (OSHA) and the Environmental Protection Agency (EPA)

Tempered glass heating and immediately cooling it 6 to 7 times stronger
Acrylic glass can be made out of polycarbonate acrylic, which is stronger than
standard glass but produces toxic fumes if burned.
The strongest window material is glass-clad polycarbonate good for wide range like
fire chemical and breakage.

passive relocking function, it can detect when someone attempts to tamper with it,
in which case extra internal bolts will fall into place to ensure it cannot be compromised.

Common-mode noise is electrical noise between the hot and ground wire and between
the neutral and ground wire

If a safe has a thermal relocking function, when a certain temperature is met (possibly from drilling), an extra lock is implemented to ensure the valuables are properly protected.


Capacitance detectors monitor an electrical field surrounding the object being monitored. They are used for spot protection within a few inches of the object, rather than for overall room security monitoring used by wave detectors.

The focal length value relates to the angle of view that can be achieved. Short focal length lenses provide wider-angle views, while long focal length lenses provide a narrower view. The size of the images shown on a monitor, along with the area covered by one camera, is defined by the focal length. For example, if a company implements a CCTV camera in a warehouse, the focal length lens values should be between 2.8 and 4.3 millimeters (mm) so the whole area can be captured. If the company implements another CCTV camera that monitors an entrance, that lens value should be around 8mm, which allows a smaller area to be monitored.

depth of field refers to the portion of the environment that is in focus when shown on the monitor. The depth of field varies depending upon the size of the lens opening, the distance of the object being focuse on, and the focal length of the lens. The depth of field increases as the size of the lens opening decreases, the subject distance increases, or the focal length of the lens decreases. So, if you want to cover a large area and not focus on specific items, it is best to use a wide-angle lens and a small lens opening.

EPA-approved replacements for Halon: FM-200, NAF-S-III, CEA-410, FE-13, Water, Inergen, Argon and Argonite

Rate-of-rise temperature sensors usually provide a quicker warning than fixed-temperature sensors

Lighting should be used to discourage intruders and provide safety for personnel, entrances, parking areas and critical sections. Critical areas should be illuminated 8 feet high and 2 feet out.

CISSP CBK 4 Telecom and Network security

Forth domain as under.

Telecom and Network security

Quarter Inch Cartridge drives (QIC). This format is mostly used for home/small office backups, has a small capacity, and is slow, but inexpensive.

Digital Linear Tape (DLT) is only 0.498 inches (8mm Tape format) in size, yet the compression techniques and head scanning process make it a large capacity and fast tape the QIC and DAT 5Mbps. Digital Audio Tape (DAT)

LTO (Linear Tape-Open) open-format technology and storage in TB

Application: Gateway

Presentation: encryption, compression, formating

Session:

Transport:

Network: Router

Datalink: Bridge, Switch

Physical: Repeater

Amplitude (height of the signal)

Frequency (number of waves in a defined period of time)

Digital signals are more reliable to be used over a longer distance because can easily be extracted from noise and retransmitted and it has only two possible discrete values 1 and 0

ASynchronous communication sender can send data at any time, and the receiving end must always be ready. (Modem use start and stop bit Asynchronous)

Synchronous communication takes place between two devices that are synchronized usually via a clocking mechanism (Remember synchronous Token was time based access control)

Baseband uses the entire communication channel for its transmission, Ethernet is a baseband technology that uses the entire wire for just one channel.

Broadband divides the communication channel into individual and independent channels.

***Important to note that node authentication, by itself, should not be used to establish trustworthiness of a user within the network.

Fast Ethernet uses the traditional CSMA/CD

wireless LAN technology, 802.11, usesCSMA/CA for its media access functionality.

Token Ring IEEE 802.5 standard. Each computer is connected to a central hub, called a Multistation Access Unit (MAU) 16 Mbps Speed

UTP Categories Cat 1 voice grade Cat 2 Data 4 Mbps Cat 3 10 Mbps for Token ring Cat 4 16 Mbps Cat 5 100 Mbps and Cat 5E 1 Gbp.

Polling LAN media access method setup primary and secondary station primary ask secodary if it need to transmit.

MAC to IP address ARP

IP to MAC = RARP

Attackers alter a system’s ARP table so it contains incorrect information known ARP table poisoning. The attacker’s goal is to receive packets intended for another computer. This is a type of masquerading attack

Wires are encapsulated within pressurized conduits so if someone attempts to access a wire, the pressure of the conduit will change, causing an alarm to sound.

Class D multicast uses IGMP protocol.

DHCP Discover, client searches for the present DHCP Server

DHCP Offer, Server offer a client an available IP address

DHCP Request, Client Confirms accepting allocated setting

DHCP Pack. ack that ip address has been allocated with lease time.

DHCP snooping ensures that DHCP servers can assign IP addresses to only selected systems, identified by their MAC addresses

RARP The diskless machine hold mac adress it broadcast the information for a specific hardware address and RARP Server reponds with IP address

RARP evolved into BOOTP, which evolved into DHCP.

ARP knows the IP address and broadcasts to find the matching hardware address, the MAC address. RARP knows the hardware address and broadcasts to find the IP address

Loki attack ICMP status packet is stuffed with data as well

Routers usually do not pass broadcast information, but bridges do pass broadcast information

e-mail gateway convert the message into a standard that all mail servers understand X.400

phreaker (a phone hacker)

Types of Firewalls

1. Packet filtering simple ACL based (Network Layer)

2. Stateful keep track of every connection state and maintain state table. (Transport Layer 3rd Generation)

3. Proxy 2nd generation firewall, it had 2 types

3.1 application-level (layer 7 make decision on contents of packet) does not understand a certain protocol

3.2 circuit-level Proxy firewalls (session Layer) SOCKS is a circuit-level proxy gateway

4. Dynamic packet filtering 4th Generation firewall, once inside system decide to communicate firewall creates an ACL that allows the external entity to communicate with the internal system via this high port

5. Kernel proxy 5th generation FW uses stacking for packet inspection,.(Application Layer)

Three main FW architecture

• Screened host

• Dual-home

• Screened subnet

legal honeypot Enticement system indicating that free Songs are available to download on the honeypot system is entrapment, because this sets up the user to access the honeypot for reasons other than the intent to harm

DNS Hierarical structure 1992 the National Science Foundation (NSF)

authoritative root DNS server contained 13 files one for each root server.

DNS namespaces are split up administratively into zones and record are called Resource Record

It is recomended to have two DNS servers Primary and secondary and zones are shared via zone transfer.

cyber squatters, individualswho register prominent or established names, hoping to sell these later

Protocol field values TCP 6, UDP 17, ICMP 1, IGMP 2

Diverse routing is a method of providing telecommunication continuity that involves routing traffic through split or duplicate cable facilities. Alternative routing is accomplished via alternative media such as copper cable or wire optics

Transport layer is responsible for reliable data delivery , Congestion Control

IEEE 802.5 standard defines the token ring media access method.

802.3 refers to Ethernet's CSMA/CD,

802.11 refers to wireless communications and

802.2 refers to the logical link control.

NFS allow Different types of file systems to interoperate.

FRDS+ (Failure Resistant Disk System Plus).

The physical layer (layer 1) defines the X.24, V.35, X.21 and HSSI standard interfaces.

Circuit level proxy (Session Layer) does not anayze the application content of the packet in making its decisions, it has lower overhead than an application level proxy

Internet Message Access Protocol, version 4 (IMAP4) as an Internet protocol by which a client workstation can dynamically access a mailbox on a server host to manipulate and retrieve mail messages that the server has received and is holding for the client. IMAP4 has mechanisms for optionally authenticating a client to a server and providing other security services

TLS = (TLS) Handshake Protocol + TLS Record Protocol

Digital Signal level 1 (DS-1) is the framing specification used for transmitting digital signals at 1.544 Mbps on a T1 facility. DS-0 is the framing specification used in transmitting digital signals over a single 64 Kbps channel over a T1 facility. DS-3 is the framing specification used for transmitting digital signals at 44.736 Mbps on a T3 facility.

The Point-to-Point Protocol (PPP) was designed to support multiple network types over the same serial link SLIP only support IP over serial network

A Failure Resistant Disk System provides the ability to reconstruct the contents of a failed disk onto a replacement disk and provides the added protection against data loss due to the failure of many hardware parts of the server.

Data Link layer of the OSI/ISO model provides SLIP, CSLIP and PPP protocol.

DOD Application Layer contains protocols that implement user-level functions, such as mail delivery, file transfer and remote login.

DOD Host-to-Host Layer handles connection rendez vous, flow control, retransmission of lost data, and other generic data flow management between hosts. The mutually exclusive TCP and UDP protocols are this layer's most important members.

DOD Internet Layer is responsible for delivering data across a series of different physical networks that interconnect a source and destination machine. Routing protocols are most closely associated with this layer, as is the IP Protocol, the Internet's fundamental protocol.

DOD Network Access Layer is responsible for delivering data over the particular hardware media in use. Different protocols are selected from this layer, depending on the type of physical network

A differential backup is a partial backup that copies a selected file to tape only if the archive bit for that file is turned on, indicating that it has changed since the last full backup. A differential backup leaves the archive bits unchanged on the files it copies.

A full copy backup (which Microsoft calls a copy backup) is identical to a full backup except for the last step. The full backup finishes by turning off the archive bit on all files that have been backed up. The full copy backup instead leaves the archive bits unchanged.

Structured Query Language (SQL), implemented at the session layer (layer 5)

The Secure Electronic Transaction (SET) protocol requires two pair of asymmetric keys and two digital certificates.(Application Layer)

Hierarchical Storage Management (HSM) is commonly employed in very large data retrieval systems

Write-once, read-many (WORM) optical disk "jukeboxes" are used for archiving data that does not change.

Secure HTTP (S-HTTP) is designed to send individual messages securely. SSL is designed to establish a secure connection between two computers. SET was originated by VISA and MasterCard as an Internet credit card protocol using digital signature

Secure HTTP (S-HTTP), which operates at the application layer. S-HTTP is being overtaken by SSL and TLS works on transport layer#

X.400 is used in e-mail as a message handling protocol. X.500 is used in directory services. X.509 is used in digital certificates and X.800 is used a network security standard

An open network architecture is one that no vendor owns

intranet, a “private” network that uses Internet technologies.

extranet extends outside the bounds of the company’s network to enable two or more companies.

MAN Connects LAN, MANs are Synchronous Optical Networks (SONETs) or FDDI rings

SONET self HEaling network

ATM encapsulates data in fixed cells 53 bytes

T3 = 28 T1

T2 = 4 T1

T4 = 168 T1

T1 1.544 Mbps

T3 44.736 Mbps

OC1 51.84 Mbps

Statistical time-division multiplexing (STDM) determines in real time how much time each device should be allocated for data transmission

Frequency division Multiplexing: in available wireless spectrum Each frequency within the spectrum is used as a channel to move data

CSU/DSU provides a digital interface for Data Terminal Equipment (DTE), such as terminals, multiplexers, or routers, and an interface to the Data Circuit-Terminating Equipment (DCE) device,

circuit Switching Dedicated virtual link.

Packet Switching one connection can pass through a number of different individual devices.X.25 , framerelay

DTE is usually a customer-owned device

DCE is the service provider’s device

Switched Multimegabit Data Service (SMDS) is a high-speed packetswitched technology

Synchronous Data Link Control (SDLC) Dedicated leased lines IBM 1970

High-level Data Link Control (HDLC) protocol is also a bit-oriented link layer protocol used for transmission over synchronous lines (time based)

HDLC is extention of SDLC

High-Speed Serial Interface (HSSI) is an interface used to connect multiplexers and

routers to high-speed communications services

SIP is an application layer protocol that can work over TCP or UDP

isochronous network contains the necessary protocols and devices that guarantee continuous bandwidth without interruption.

voice stream is carried on media protocols such as the Real-time Transport Protocol (RTP).

User Agent Client (UAC) IPhone, SIP Phone

User Agent Server (UAS) SIP Server

New spam for VOIP = SPIT (Spam over Internet Telephony).

WEP only provide system authentication however 802.1X provides User authentication.

supplicant (wireless device),

authenticator (AP),

Authentication server (usually a RADIUS server).

EAP allows for mutual authentication to take place between the authentication server and wireless device and provide flexibility.

802.11i does not specify particular authentication protocols Cisco uses a purely password-based authentication framework called Lightweight Extensible Authentication Protocol (LEAP). Other vendors, including Microsoft, use EAP and Transport Layer Security (EAP-TLS), which carries out authentication through digital certificates. And yet another choice is Protective EAP (PEAP), where only the server uses a digital certificate

WEP Problems

1. static WEP encryption keys on all devices (every one have same pasword in company)

2. how initialization vectors (IVs) + RC4 are used that are XOR with packet to produce cipher text (IV value is used over and over again)

3. integrity assurance issue ICV Integrity check value

802.15 Bluetooth 1 to 3 Mbps 2.4 GHz Bluejacking is a type of attach some one send message to avoid setup ur blouetooth device undiscoverable.range is 10 Meter

For WAP transport layer security protocol called Wireless Transport Layer Security (WTLS) When WTLS data come for Internet service provider have to decrypt and encrypt it back in TLS And SSL so it is in plain taxt for a second whihc is called gap in the WAP

WAP uses an XML-compliant Wireless Markup Language (WML

Imode is same as WAP but target entertainment market , i-Mode works with a slimmed-down version of HTML called compact HTML

“log scrubbers” that remove traces of the attacker’s activities from the system logs

First generation firewall" packet filtering firewalls

"Second generation firewall" Proxy based firewalls. Under proxy based firewall you have Application Level Proxy and also the Circuit-level proxy firewall. The application level proxy is very smart and understand the inner structure of the protocol itself. The Circuit-Level Proxy is a generic proxy that allow you to proxy protocols for which you do not have an Application Level Proxy. This is better than allowing a direct connection to the net. Today a great example of this would be the SOCKS protocol.

"Third generation firewall" Stateful Inspection firewall. This type of firewall makes use of a state table to maintain the context of connections being established.

"Fourth generation firewall" dynamic packet filtering firewall

WAP Stack

Wireless Markup Language (WML)

Wireless Application Environment (WAE)

Wireless Transport Layer Security Protocol (WTLS)

Wireless Application Environment (WAE)

Wireless Session Layer (WSL)

Wireless Transport Layer (WTL)

TCP Wrapper is a program that monitors incomming packets. It is considered open source. TCP Wrappers can be used to control when UDP servers start, but it has no other control over the server once it is started. UDP servers may continue to run after they've finished processing a legitimate request.

Again PPTP operates at Layer 2 of the OSI model.

High-rate Digital Subscriber Line (HDSL) delivers 1.544 Mbps of bandwidth each way over two copper twisted pairs.

SDSL also delivers 1.544 Mbps but over a single copper twisted pair.

IPSec Transport mode is established when the enpoint is a host

10Base2, also known as RG58, or thinnet, is limited to 185 meters. 10Base5, also known as RG8/RG11 or thicknet, is limited to 500 meters

Failure Resistand Disk System (FRDS) is that it enables the continuous monitoring of these parts and the alerting of their failure.

AH (51) provides integrity, authentication, and non-repudiation. Security Associations (SAs) can be combined into bundles to provide authentication, confidentialility and layered communication.

The Well Known Ports are those from 0 through 1023.

The Registered Ports are those from 1024 through 49151.

The Dynamic and/or Private Ports are those from 49152 through 65535.

There are six basic security services defined by the OSI:

Authentication, access control, data confidentiality, data integrity, nonrepudiation and logging and monitoring.

POP 110

Post Office Protocol (POP2) 109

Network News Transfer Protocol 119

NetBIOS 139

The TRANSPORT LAYER establish logical connection between the END POINTS of an internetwork, that is, the originating host and the destination host.

The Land attack involves the perpetrator sending spoofed packet(s) with the SYN flag set to the victim's machine on any open port that is listening

The Boink attack, involves the perpetrator sending corrupt UDP packets to the host. It however allows the attacker to attack multiple ports where Bonk was mainly directed to port 53 (DNS