CISSP认证学习讨论区

omni

I believe the total numbers of the CISSPs is over 11,000 worldwide.

netbanker

do u work on network security area?

armitage

According to www.cn.cisspworld.com,  there are 57 CISSPs in China, and 11500 in the world.

davidzhang0086

好像有个FTP地址吧？
是不是要斑竹特别授权才可以知道呢？
一定要发50个帖子才能得到授权吗？
可以通融一下吗？

omni

a few points I can recall from the Prep Guide book:
A)
- MAC: owner+system grant accee, based on Security Label on both subject (user) and object (data)
- DAC: owner grant access
- Role Based AC: related to job function, granted to a group of people of same job function - at least 2 list: user + ACL - userA->bank teller & ACL->bank teller can access fileABC
- Rule Based AC: managed by ACL - in ACL, user is related to capabilities
B)
- Preventitive: login, login banner, firewall, anti-virus (before affected)
- Detective: audit trail, log file, IDS, anti-virus (after affected)
- Corrective: back/recoveray, insident handling, anti-virus (clean up)
C)
- SSO: kerbero - uses secret/symmetricKey - authentication services is single point of failure
- SSO: sesame - uses public+secret key
D)
- Multifactor authentication: something you are, you have and you know
- Smart Card / Token / Biometrics: something you have + something you know + something you are (biometrics only)
- Token: main purpose is something you know

(more to come)

omni

A)
- Preventitive: fence, double doors, door locks, security gusrds, badges, warning signs, HOVAC, site selection
- Detective: motion detector, cctv, smoke/fire detector
- Corrective: UPS, fire distinguish system
B)
- Unmanned site: CO2 okay, Halon product is fading out as harmful to Ozone
- Manned site: dry pipe system
- Backup site should have the same secure level as operation site

omni

Transient Electromagnetic Pulse Emanation Standard

http://rr.sans.org/encryption/TEMPEST.php

omni

HOVAC -> should be HVAC

cisamaqing

今年的2场考试耗费精力和体力颇大，而且时间上在年底考试也冲突，而且通过考试不是End，发现在知识的整体架构及眼界上还存在不少需要弥补的东西，而且这个岁数对证书和Title的渴求也不象前几年那么强烈了。

我觉得在实务上的提高和整体把握“安全”是重要的，CISSP不应该只关心“安全技术”，因为他服务的客户需要的是“安全”，而不是“安全技术”。

希望小龙，OMNI指正。

wuyuanya

支持马先生的想法。