You're reading from Certified Information Systems Security Professional (CISSP) Exam Guide Become a certified CISSP professional with practical exam-oriented knowledge of all eight domains

Product type Paperback

Published in Sep 2024

Publisher Packt

ISBN-13 9781800567610

Length 526 pages

Edition 1st Edition

Tools

Kali Linux

Concepts

Cryptography

Authors (3):

Ted Jordan

Ric Daza

Hinne Hettema

View More author details

Table of Contents (28) Chapters

Preface

1. Intro I: Becoming a CISSP FREE CHAPTER

2. Intro II: Pre-Assessment Test

3. Chapter 1: Ethics, Security Concepts, and Governance Principles

4. Chapter 2: Compliance, Regulation, and Investigations

5. Chapter 3: Security Policies and Business Continuity

6. Chapter 4: Risk Management, Threat Modeling, SCRM, and SETA

7. Chapter 5: Asset and Privacy Protection

8. Chapter 6: Information and Asset Handling

9. Chapter 7: Secure Design Principles and Controls

10. Chapter 8: Architecture Vulnerabilities and Cryptography

11. Chapter 9: Facilities and Physical Security

12. Chapter 10: Network Architecture Security

13. Chapter 11: Securing Communication Channels

14. Chapter 12: Identity, Access Management, and Federation

15. Chapter 13: Identity Management Implementation

16. Chapter 14: Designing and Conducting Security Assessments

17. Chapter 15: Designing and Conducting Security Testing

18. Chapter 16: Planning for Security Operations

19. Chapter 17: Security Operations

20. Chapter 18: Disaster Recovery

21. Chapter 19: Business Continuity, Personnel, and Physical Security

22. Chapter 20: Software Development Life Cycle Security

23. Chapter 21: Software Development Security Controls

24. Chapter 22: Securing Software Development

25. Chapter 23: Secure Coding Guidelines, Third-Party Software, and Databases

26. Chapter 24: Accessing the Online Practice Resources

27. Other Books You May Enjoy

Understanding the Fundamental Concepts of Security Models

Security models are designed to prioritize access to data based on confidentiality, availability, or integrity. In this section, we discuss popular security models and whether they focus on the confidentiality, integrity, or availability of data.

Bell-LaPadula

The Bell-LaPadula model prioritizes confidentiality over integrity and availability in systems such as mandatory access control (MAC). This is probably best explained by an example using Figure 7.3. The diagram shows three levels of clearance: top secret, secret, and confidential. If the user (data subject) has secret access, they can read secret and confidential documents (objects) but not top secret. This is called the Simple Security property, also known as read down, no read up.

The data subject can save objects at their clearance level or higher but cannot save documents at lower levels. This is called the Star Security property, also known as write up, no...