CISSP CBK 5 Physical Security

Physical Security

Crime Prevention Through Environmental Design (CPTED) is a discipline that outlines how the proper design of a physical environment can reduce crime by directly affecting human behavior

Soda acid removes fuel from the fire by discharging a thick form that moves the fire away from the fuel supply.
Carbon dioxide removes oxygen from the fire.
Water reduces fire temperature.
Halon (gas) or its substitutes interferes with the chemical reactions between elements in the fire.
clapper valve hold the water back in Dray pipe

Auxiliary station alarms automatically cause an alarm originating in a data center to be transmitted over the local municipal fire or police alarm circuits for relaying to both the local police/fire station and the appropriate headquarters
auditing is a technical control auditing as a audit logs

static charge of 1500 volts is able to cause disk drive data loss.
A charge of 1000 volts is likely to scramble monitor display and a charge of 2000 volts can cause a system shutdown.
It should be noted that charges of up to 20,000 volts or more are possible under conditions of very low humidity with non-static-free carpeting.

The preaction system combines both the dry and wet pipe systems,is most recommended in Comms room . though it is WATER point to remember.

The organization may also have to comply with requirements of the Occupational Safety and Health Administration (OSHA) and the Environmental Protection Agency (EPA)

Tempered glass heating and immediately cooling it 6 to 7 times stronger
Acrylic glass can be made out of polycarbonate acrylic, which is stronger than
standard glass but produces toxic fumes if burned.
The strongest window material is glass-clad polycarbonate good for wide range like
fire chemical and breakage.

passive relocking function, it can detect when someone attempts to tamper with it,
in which case extra internal bolts will fall into place to ensure it cannot be compromised.

Common-mode noise is electrical noise between the hot and ground wire and between
the neutral and ground wire

If a safe has a thermal relocking function, when a certain temperature is met (possibly from drilling), an extra lock is implemented to ensure the valuables are properly protected.


Capacitance detectors monitor an electrical field surrounding the object being monitored. They are used for spot protection within a few inches of the object, rather than for overall room security monitoring used by wave detectors.

The focal length value relates to the angle of view that can be achieved. Short focal length lenses provide wider-angle views, while long focal length lenses provide a narrower view. The size of the images shown on a monitor, along with the area covered by one camera, is defined by the focal length. For example, if a company implements a CCTV camera in a warehouse, the focal length lens values should be between 2.8 and 4.3 millimeters (mm) so the whole area can be captured. If the company implements another CCTV camera that monitors an entrance, that lens value should be around 8mm, which allows a smaller area to be monitored.

depth of field refers to the portion of the environment that is in focus when shown on the monitor. The depth of field varies depending upon the size of the lens opening, the distance of the object being focuse on, and the focal length of the lens. The depth of field increases as the size of the lens opening decreases, the subject distance increases, or the focal length of the lens decreases. So, if you want to cover a large area and not focus on specific items, it is best to use a wide-angle lens and a small lens opening.

EPA-approved replacements for Halon: FM-200, NAF-S-III, CEA-410, FE-13, Water, Inergen, Argon and Argonite

Rate-of-rise temperature sensors usually provide a quicker warning than fixed-temperature sensors

Lighting should be used to discourage intruders and provide safety for personnel, entrances, parking areas and critical sections. Critical areas should be illuminated 8 feet high and 2 feet out.

CISSP CBK 1 Information Security and Risk Mgmt

Information Security and Risk Mgmt

Hi guys, I have strated writing down Cramm sheet for CISSP Exam, though it is tough task buy I am commited to complete it by the end of June 2011.

All the best for Exam.


Control Objectives for Information and related Technology (CobiT) is a framework and set of best practices developed by the Information Systems Audit and Control Association (ISACA) and the IT Governance Institute (ITGI)

CobiT was derived from the COSO framework, developed by the Committee of Sponsoring Organizations (COSO)

COSO is a model for corporate governance and CobiT is a model for IT governance. COSO deals more at the strategic level, while CobiT focuses more at the operational level. You can think of CobiT as a way to meet many of the COSO objectives, but only from the IT perspective.

BS7799 Part 1, which outlines control objectives and a range of controls that can be used to meet those objectives; and BS7799 Part 2, which outlines how a security program can be set up and maintained. BS7799 Part 2 also served as a baseline that organizations could be certified against. Organization can decide to be accredited against for part 2 or only the portion of part 2 same is the case with ISO17799

ISO9000 Quality Control

• ISO/IEC 27001 Based on British Standard BS7799 Part 2, which is establishment, implementation, control, and improvement of the Information Security Management System
• ISO/IEC 27002 Code of practice providing good practice advice on ISMS (previously known as ISO 17799), itself based on British Standard BS 7799 Part 1
• ISO/IEC 27004 A standard for information security management measurements
• ISO/IEC 27005 Designed to assist the satisfactory implementation of information security based on a risk management approach
• ISO/IEC 27006 A guide to the certification/registration process
• ISO/IEC 27799 A guide to illustrate how to protect personal health information
http://www.27000.org/

CobiT and COSO provide the “what is to be achieved,” but not the “how to achieve
it.” This is where ITIL and the ISO/IEC 27000 series come in


Annualized Loss Expectancy (ALE) is the average monetary value of losses per year.

Annualized Loss Expectancy = Single Loss Expectancy * Annualized Rate of Occurrence



Discretionary Access Control (DAC) DACs are an access control policy that restricts
access to files and other system resources based on the identity and assignment of
the user and/or the groups to which the user belongs. DACs are considered a
policy-based control.

Functional Requirements evaluation means, “Does this solution carry out the
required tasks?”

Assurance requirements evaluation means, “How sure are we of the level of
protection this solution provides?” Assurance requirements encompass the integrity,
availability, and confidentially aspects of the solution

The Annnualized Rate of Occurence (ARO) is a value that represents the estimated
frequency in which a threat is expected to occur.if 100 DEO doo 1 mistake every
month and 12*100 = 1200 ARO

Good Configuration Management process is one that can
(1) accommodate change;
(2)accommodate the reuse of proven standards and best practices;
(3) ensure that all requirements remain clear, concise, and valid;
(4) ensure changes, standards, and requirements are communicated promptly and precisely;
(5) ensure that the results conform to each instance of the product.

Risk is the possibility of damage happening and the ramifications of such damage
should it occur. Information risk management (IRM) is the process of identifying
and assessing risk, reducing it to an acceptable level, and implementing the right
mechanisms to maintain that level. There is no such thing as a 100 percent secure
environment.

Standards are a "Mandatory statement of minimum requirements that support some part
of a policy, the standards in this case is your own company standards and not
standards such as the ISO standards

Guidelines are discretionary or optional controls used to enable individuals to make judgments with respect to security actions

Procedures are step-by-step instructions in support of of the policies, standards, guidelines and baselines. The procedure indicates how the policy will be implemented and who does what to accomplish the tasks

Test equipment must be secured. There are equipment and other tools that if in the wrong hands can "sniff" a network traffic and be used to commit fraud. The storage and use of this equipment should be detailed in the security policy for this reason.


It is common for system development and systems maintenance to be undertaken by the same person. In both cases the programmer requires access to the source code in the development environment, but should not be allowed access in the production environment.
Other choices are not correct.

The roles of security administration and change management are incompatible functions. The level of security administration access rights could allow changes to go undetected. Computer operations and system development are incompatible since it would be possible for an operator to run a program that he/she had amended. The system development and change management task are incompatible because the combination of system development and change control would allow program modifications to bypass change control approvals.


The common steps used the the development of security policy are initiation of the
project, evaluation, development, approval, publication, implementation, and
maintenance.

The other choices listed are the phases of the software development life cycle and not the step used to develop documents such as Policies, Standards, etc...

The data owner, not the database administrator, is responsible for accurate use of the information and should normally provide authorization for users to gain access to computerized information. The database administrator (DBA) handles technical matters, not access authorization to data.

Threat analysis is the examination of threat sources against system vulnerabilities to determine the threats for a particular system in a particular operational environment.

A risk analysis has three main goals: identify risks, quantify the impact of potential threats, and provide an economic balance between the impact of the risk and the cost of the associated countermeasure.

Choosing the best countermeasure is not part of the risk analysis. The Operations Security domain is concerned with triples - threats, vulnerabilities and assets.

Risk Analysis Steps

1 Assign Vlaue to Assets
2 Estimate Potential loss per threat (SLE)
3 Perform a threat Analysis (ARO)
4 Derive overall annlai Loss potential per threat (ALE)
5 Reduce/ Transfer/ Avoid and Accept the Risk
SLE = Asset Value x Exposure Factor
ALE = SLE x ARO

Risk Analysis = value to assets + risk analysis and assessment + Countermeasure
selection


Advisory
Advisory policies are security polices that are not mandated to be followed but are strongly suggested, perhaps with serious consequences defined for failure to follow them (such as termination, a job action warning, and so forth). A company with such policies wants most employees to consider these policies mandatory.

Most policies fall under this broad category.

Advisory policies can have many exclusions or application levels. Thus, these policies can control some employees more than others, according to their roles and responsibilities within that organization. For example, a policy that
requires a certain procedure for transaction processing might allow for an alternative procedure under certain, specified conditions.
Regulatory
Regulatory policies are security policies that an organization must implement due to compliance, regulation, or other legal requirements. These companies might be financial institutions, public utilities, or some other type of organization that operates in the public interest. These policies are usually very detailed and are specific to the industry in which the organization perates.
Regulatory polices commonly have two main purposes:

1. To ensure that an organization is following the standard procedures or base practices of operation in its specific industry
2. To give an organization the confidence that it is following the standard and accepted industry policy

Informative
Informative policies are policies that exist simply to inform the reader. There are no implied or specified requirements, and the audience for this information could be certain internal (within the organization) or external parties. This does not mean that the policies are authorized for public consumption but that they are general enough to be distributed to external parties (vendors accessing an extranet, for example) without a loss of confidentiality.
Computer security should be first and foremost cost-effective.

Access to facilities by is not considered as a personnel security control, but as a Physical/environmental control.

threats × vulnerability × asset value = total risk
(threats × vulnerability × asset value) × controls gap = residual risk

The Sec policy should not dictate business objectives
Isssue Specific Policy (email usage policy)
system-specific policy (approved SW list, Hos IDS and FW are deployed

**standards, guidelines, and procedures are the tactical (short term Goal) tools used to achieve and support the directives in the security policy, which is considered the strategic goal (long term end point Goal)

security policy says customer information should be protected standard says data stored in DB should be AES and If in transit should be IPSEC and Procedure explains how to setup AES encryption, guidelines cover how to handle cases when data is accidentally corrupted or compromised during transmission

Due Diligence = Do Detect (understand risk company faces)
Due Care = Do Correct (steps taken do identify the risk)

• Confidential
• Private
• Sensitive
• Public

and now Military

• Top Secret
• Secret
• Confidential
• sensitive but unclassified
• unclassified

commercial sector is described next:

• For official use only Financially sensitive
• Proprietary Protects competitive edge
• Privileged Ensures conformance with business standards and laws
• Private Contains records about individuals

Sensitive : Requires special precautions to ensure the integrity and confidentiality of the data by protecting it from unauthorized modification or deletion. b) Requires higher than normal assurance of accuracy and completeness.
Examples : Financial Information , Details Of Projects , Profit Earnings and Forecasts
Organization : Commercial Businesses
Private : a) Personal information for use within a company b) Unauthorized disclosure could adversely affect personnel or company.
Examples : Work History , Human resources information , Medical information
Organization : Commercial Businesses
Secret : a) If disclosed , it could cause serious damage to national security.
Examples : Deployment plans for troops , Nuclear bomb placement