The cybersecurity body of knowledge: the ACM/IEEE/AIS/IFIP recommendations for a complete curriculum in cybersecurity
Gespeichert in:
Bibliographische Detailangaben
Hauptverfasser: Shoemaker, Dan (VerfasserIn), Kohnke, Anne (VerfasserIn), Sigler, Ken (VerfasserIn)
Format: Elektronisch E-Book
Sprache:English
Veröffentlicht: Boca Raton ; London ; New York CRC Press, Taylor & Francis Group [2020]
Schriftenreihe:Internal audit and IT audit
Schlagworte:
Online-Zugang:TUM01
Beschreibung:Cover -- Half Title -- Series Page -- Title Page -- Copyright Page -- Table of Contents -- Foreword 1 -- Foreword 2 -- Author Biographies -- Introduction -- Chapter 1 Securing Cyberspace is Every Body's Business -- Introduction: The Current Situation Is Out of Control -- The Challenge: How Do You Protect Something that Doesn't Actually Exist? -- We Must Re-evaluate Our Assumptions -- The Adversary Changes Things -- The Three-Legged Stool -- Learning to Play Better with Others -- Creating a Holistic Solution -- The Importance of Knowing What to Do -- Enabling Common Understanding -- Education Is the Key -- The Body of Knowledge and Educational Strategy -- Cybersecurity as an Academic Study -- The Association for Computing Machinery (ACM) -- The International Society of Electrical and Electronic Engineers (IEEE) -- The Association for Information Systems (AIS) -- The International Federation for Information Processing (IFIP) -- The Importance of Unified Recommendations about Areas of Vital Interest -- Circumscribing the Field: Background and Intention of CC2005 -- Defining the Elements of the Discipline of Cybersecurity: CSEC2017 -- Knowledge Area One: Data Security -- Knowledge Area Two: Software Security -- Knowledge Area Three: Component Security -- Knowledge Area Four: Connection Security -- Knowledge Area Five: System Security -- Knowledge Area Six: Human Security -- Knowledge Area Seven: Organizational Security -- Knowledge Area Eight: Societal Security -- Real-World Utilization of the CSEC2017 Body of Knowledge -- CSEC2017 Framework Areas of Application -- Thirty Review Questions: Introduction to the CSEC Standard -- You Might Also Like to Read -- Chapter Summary -- Keywords -- References -- Chapter 2 The Cybersecurity Body of Knowledge -- Bodies of Knowledge are Essential Tools in Educational Settings -- Bodies of Knowledge
Making Cybersecurity Teaching Real -- Validating Curricular Concepts -- Applying the CSEC2017 -- The CSEC2017 Model -- The CSEC2017 Organization -- The CSEC2017 Implementation Process -- Knowledge Area One: Data Security -- Knowledge Area Two: Software Security -- Knowledge Area Three: Component Security -- Knowledge Area Four: Connection Security -- Knowledge Area Five: System Security -- Knowledge Area Six: Human Security -- Knowledge Area Seven: Organizational Security -- Knowledge Area Eight: Societal Security -- Twenty Review Questions: The Cybersecurity Body of Knowledge -- You Might Also Like to Read -- Chapter Summary -- Keywords -- References -- Chapter 3 Data Security -- Surviving in a Digital Era -- The CSEC2017 Data Security Knowledge Units -- Knowledge Unit One: Cryptography -- Basic Concepts -- Advanced Concepts -- Mathematical Background -- Historical Ciphers -- Symmetric (Private Key) Ciphers -- Asymmetric (Public Key) Ciphers -- Knowledge Unit Two: Digital Forensics -- Introduction -- Legal Issues -- Digital Forensics Tools -- Investigatory Processes -- Acquisition and Preservation of Digital Evidence -- Analysis of Evidence -- Presentation of Results -- Authentication of Evidence -- Reporting, Incident Response, and Handling -- Mobile Forensics -- Knowledge Unit Three: Data Integrity and Authentication -- Authentication Strength -- Password Attacks -- Password Storage Techniques -- Data Integrity -- Knowledge Unit Four: Access Control -- Physical Data Security -- Logical Data Access Control -- Secure Architecture Design -- Data Leak Prevention -- Knowledge Unit Five: Secure Communication Protocols -- Application and Transport Layer Protocols -- Attacks on Transport Layer Security -- Internet/Network Layer -- Privacy Preserving Protocols -- Data Link Layer -- Knowledge Unit Six: Cryptanalysis -- Classical Attacks
Side-Channel Attacks -- Attacks against Private Key Ciphers -- Attacks against Public Key Ciphers -- Algorithms for Solving the Discrete Log Problem -- Attacks on RSA -- Knowledge Unit Seven: Data Privacy -- Knowledge Unit Eight: Information Storage Security -- Disk and File Encryption -- Data Erasure -- Data Masking -- Database Security -- Data Security Law -- Chapter Review Questions -- You Might Also Like to Read -- Chapter Summary -- Learning Objectives for the Data Security Knowledge Area -- Keywords -- References -- Chapter 4 Software Security -- Building Pathways toward Software Security -- The CSEC2017 Software Security Knowledge Units -- Knowledge Unit One: Fundamental Principles -- Least Privilege -- Fail-Safe Defaults -- Complete Mediation -- Separation of Duties -- Minimize Trust -- Economy of Mechanism -- Minimize Common Mechanism -- Least Astonishment -- Open Design -- Layering -- Abstraction -- Modularity -- Complete Linkage -- Design for Iteration -- Knowledge Unit Two: Design -- Derivation of Security Requirements -- Specification of Security Requirements -- Software Development Life Cycle/Security Development Life Cycle -- Programming Languages and Type-Safe Languages -- Knowledge Unit Three: Implementation -- Validating Input and Checking Its Representation -- Using API's Correctly -- Using Security Features -- Checking Time and State Relationships -- Handling Exceptions and Errors Properly -- Programming Robustly -- Encapsulating Structures and Modules -- Taking Environment into Account -- Knowledge Unit Four: Analysis and Testing -- Static and Dynamic Analysis -- Unit Testing -- Integration Testing -- Software Testing -- Knowledge Unit Five: Deployment and Maintenance -- Configuring -- Patching and the Vulnerability Life Cycle -- Checking Environment -- DevOps -- Decommissioning and Retiring -- Knowledge Unit Six: Documentation
Installation Documents -- User Guides and Manuals -- Assurance Documentation -- Security Documentation -- Knowledge Unit Seven: Ethics -- Ethical Issues in Software Development -- Social Aspects of Software Development -- Legal Aspects of Software Development -- Vulnerability Disclosure -- What, When, and Why to Test -- Twenty Review Questions for This Chapter -- You Might Also Like to Read -- Chapter Summary -- Learning Objectives for the Component Security Knowledge Area -- Keywords -- Reference -- Chapter 5 Component Security -- It All Starts with the Components -- The CSEC2017 Component Security Knowledge Units -- Knowledge Unit One: Component Design -- Component Design Security -- Principles of Secure Component Design -- Component Identification -- Anti-reverse Engineering Techniques -- Side Channel Attack Mitigation -- Anti-tamper Technologies -- Knowledge Unit Two: Component Procurement -- Supply Chain Risks -- Supply Chain Security -- Supplier Vetting -- Knowledge Unit Three: Component Testing -- Principles of Unit Testing -- Security Testing -- Stress Testing -- Fuzz Testing -- Penetration Tests -- Knowledge Unit Four: Component Reverse Engineering -- Design Reverse Engineering -- Hardware Reverse Engineering -- Software Reverse Engineering -- Forty Review Questions: Component Security -- You Might Also Like to Read -- Chapter Summary -- Learning Objectives for the Component Security Knowledge Area -- Keywords -- Reference -- Chapter 6 Connection Security -- Introduction: The Challenge of Connecting the Enterprise -- The CSEC Connection Security Knowledge Areas -- Knowledge Unit One: Physical Media -- Transmission in a Medium -- Shared and Point-to-Point Media -- Sharing Models -- Common Technologies -- Knowledge Unit Two: Physical Interfaces and Connectors -- Hardware Characteristics and Materials -- Standards -- Common Connectors
Knowledge Unit Three: Hardware Architecture -- Standard Architectures -- Hardware Interface Standards -- Common Architectures -- Knowledge Unit Four: Distributed Systems Architecture -- Network Architectures, General Concepts -- World Wide Web -- The Internet -- Protocols and Layering -- High Performance Computing (Supercomputers) -- Hypervisors and Cloud Computing Implementations -- Vulnerabilities -- Knowledge Unit Five: Network Architecture -- General Concepts -- Common Architectures -- Forwarding -- Routing -- Switching/Bridging -- Emerging Trends -- Virtualization and Virtual Hypervisor Architecture -- Knowledge Unit Six: Network Implementations -- IEEE 802/ISO Networks -- IETF Networks and TCP/IP -- Practical Integration and Glue Protocols -- Vulnerabilities and Example Exploits -- Knowledge Unit Seven: Network Services -- Concept of a Service -- Service Models (Client-Server, Peer to Peer) -- Service Protocols and Concepts (IPC, APIs, IDLs) -- Common Service Communication Architectures -- Service Virtualization -- Vulnerabilities and Example Exploits -- Knowledge Unit Eight: Network Defense -- Network Hardening -- Implementing Firewalls and Virtual Private Networks (VPNs) -- Defense in Depth -- Honeypots and Honeynets -- Network Monitoring -- Network Traffic Analysis -- Minimizing Exposure (Attack Surface and Vectors) -- Network Access Control (Internal and External) -- Perimeter Networks/Proxy Servers -- Network Policy Development and Enforcement -- Network Operational Procedures -- Network Attacks -- Threat Hunting and Machine Learning -- Twenty Review Questions: Connection Security -- You Might Also Like to Read -- Chapter Summary -- Learning Objectives for the Connection Security Knowledge Area -- Keywords -- References -- Chapter 7 System Security -- Assembling the Parts into a Useful Whole -- The Key Role of Design in Systems
The CSEC2017 System Security Knowledge Units
Beschreibung:1 Online-Ressource
ISBN:9781000050417

Es ist kein Print-Exemplar vorhanden.

Fernleihe Bestellen Achtung: Nicht im THWS-Bestand!