Pass Your ISC CISSP Certification Easy!

Prepare with top-notch ISC CISSP certification practice test questions and answers, vce exam dumps, study guide, video training course from ExamCollection. All ISC CISSP certification exam dumps & practice test questions and answers are uploaded by users who have passed the exam themselves and formatted them into vce file format.

Domain

6. Cloud Computing Models

Let's discuss public cloud tiers. Though service-oriented architecture advocates everything as a service with the acronyms EaaS or XaaS, cloud computing providers offer their services according to different models, of which the three standard models per NIST are infrastructure as a service, platform as a service, and software as a service. These models offer increasing abstraction. As a result, they are frequently depicted as layers in a static infrastructure platform and software as a service. But these need not be related. For example, one can provide software as a service implemented on physical machines bare metal) without using underlying PaaS or IaaS layers, and conversely, one can run a programme as IaaS and access it directly without wrapping it as SaaS. Let's discuss software as a service, infrastructure as a service, and platform as a service In a little bit more detail, software as a service is the capability provided to the consumer to use the provider's application running on a cloud infrastructure. The applications are accessible from various client devices through either a thin client interface (such as a Web browser, for example, or web-based email) or a programme interface. The consumer does not manage or control the underlying cloud infrastructure, including network servers, operating systems, storage, or even individual application capabilities. With the possible exception of limited user-specific application configuration settings, infrastructure as a service (IaaS) refers to online services that provide high-level APIs used to dereference various low-level details of underlying network infrastructure like physical computing resources, location data partitioning, scaling, security backup, and more. A hypervisor, such as Oracle VirtualBox or OracleVM, runs the virtual machines as guests. Pools of hypervisors within the cloud's operational system can support large numbers of virtual machines and the ability to scale services up and down according to customer requirements. Linux containers are isolated partitions of a single Linux kernel that runs directly on physical hardware. Linux C groups and namespaces are the underlying Linux kernel technologies used to isolate, secure, and manage the containers Containerization offers higher performance than virtualization because there is no hypervisor overhead. Also, container capacity auto-scales dynamically with computing load, which eliminates the problem of over-provisioning and enables usage-based billing. The cloud frequently provides additional resources such as a virtual machine, disk, image library, frau block storage file or obvious storage firewalls, load balancers, IP addresses, virtual local area networks or VLANs, and software bundles as infrastructure as a service. The NIST definition of cloud computing describes infrastructure as a service where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, and deployed applications, and possibly limited control over select network control components such as host firewalls in IaaS. Cloud providers supply these resources on demand from their large pools of equipment installed in data centers. For wide-area connectivity, customers can use either the Internet or carrier cloud-dedicated virtual private networks to deploy their applications. Cloud users install operating system images and their application software on the cloud infrastructure. In this model, the cloud user patches and maintains the operating systems and the application software. Cloud providers typically build IaaS services on a utility computing basis. The amount of resources allocated and consumed is reflected in the cost. Platform as a Service, or PaaS, is the capability provided to the consumer to deploy onto the cloud infrastructure. consumer-created or acquired applications created using programming languages, libraries, services, and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure, including network servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application hosting environment. Let's look at a few examples of each software service. Examples would include Google Docs and Spreadsheets, NetSuite, and IBM Lotus Live Platform as a Service. Examples would include force.com, role-based long-jump Google App Engine, and Windows Zero infrastructure as a service. Examples would include joint AmazonWeb services, VMware, and Rockspace. When hosting in a cloud computing model, professionals must look at security from a different perspective. The shared responsibility approach requires that both vendors and customers take responsibility for different elements of security. In an infrastructure as a service approach, the vendor is responsible for managing the security of their hardware and data center. Customers configure the operating system applications and data, so securing those elements is primarily a customer responsibility. In a platform as a service approach, the customer still has data and application responsibility but does not directly interact with the operating system, so that responsibility shifts to the vendor. And finally, in a software as a service approach, the vendor manages almost everything, and the only responsibility that the customer has is knowing what data is stored in the service and applying appropriate access controls.

7. Public Cloud Tiers

In this lesson, we will discuss memory protection. When discussing memory protection, we want to familiarise ourselves with two types: RAM and ROM. RAM stands for Random Access Memory. and Rom stands for read-only Only Memory.So what are the different differences? Let's look at the two and compare them. RAM is the memory available for the operating system programmes and processes to use when the computer is running. Rom is the memory that comes with your computer and is prewritten to hold the instructions for booting up the computer. RAM requires a flow of electricity to retain the data. For example, when the computer is turned off, RAM will retain data without the flow of electricity. RAM is a type of volatile memory. Data in RAM is not permanently written. When you power off your computer, the data stored in RAM is deleted. RAM is a type of nonvolatile memory. Data in RAM is permanently written and is not erased when you power up your computer. There are different types of RAM, including RAM dynamic random access memory and SRAM static random access memory. There are different types of RAM, including Pram programmable read-only memory that is manufactured as blank memory. CDROMs and EPROMs (erasable programmable read-only memory) are two examples. There are many differences between Ram and Rommemory, but there are also a couple of similarities, and these are very easy to remember. Both types of memory are used by a computer, and they are both required for your computer to operate properly and efficiently. Memory management is the process of controlling and coordinating computer memory, assigning portions called blocks to various running programmes to optimise overall system performance. Memory management resides in the hardware in the operating system, in programs, and in applications. In hardware, memory management involves components that physically store data, such as RAM chips, memory caches, and flash-based SSDs or solid state drives. In the operating system, memory management involves the allocation and constant reallocation of specific memory blocks to individual programs. As user demands change at the application level, memory management ensures the availability of adequate memory for the objects and data structures of each running programme at all times. Application memory management combines two related tasks known as allocation and recycling. When a programme requests a block of memory, a part of the memory manager called the allocator assigns the block to the program. When a programme no longer needs that data and previously allocated memory blocks, those blocks become available for reassignment. This task can be done manually by the programmer or automatically by the memory manager. Memory protection is a way to control memory access rights on a computer and is a part of most modern instruction sets, set architectures, and operating systems. The main purpose of memory protection is to prevent a process from accessing memory that has not been allocated to it. This prevents a bug or malware within a process from affecting other processes or the operating system itself. An attempt to access unknown memory results in a hardware fault called a segmentation fault or storage violation exception, generally causing abnormal termination of the offending process. Memory protection for computer security includes additional techniques such as address, space layout, randomization, and executable space protection. A segmentation fault, often shortened to "setfault" or "access violation," is a fault or failure condition raised by hardware with memory protection, notifying an operating system. The software has attempted to access a restricted area of memory, a memory access violation on standard X86 computers. This is a form of general protection fault. The operating system kernel will, in response, usually perform some corrective action, generally passing a fault onto the offending process by sending the process a signal. Processes can in some cases install a custom signal handler, allowing them to recover on their own, but otherwise the operating system default signal handler is used, generally causing abnormal termination of the process via a programme crash, in other words, and sometimes a core dump. Segmentation faults are a common class of error in programmes written in languages like C that provide low-level memory access. They arise primarily due to errors and the use of pointers for virtual memory addressing, particularly illegal access. Another type of memory access error is a bus error, which also has various causes but is now much rarer. These occur primarily due to incorrect physical memory addressing or due to misaligned memory access. These are memory references that the hardware cannot address, rather than references that the process is not allowed to address. Newer programming languages may employ mechanisms designed to avoid segmentation faults and improve memory safety. For example, the Rust programming language, which appeared in 2010, employs an ownership-based model to ensure memory safety. A memory leak is a process in which a programme or application persistently retains a computer's primary memory. It occurs when the resident memory programme does not return or release allocated memoryspace even after execution, resulting in slower or unresponsive system behavior. A memory leak is also known as a space leak. A "memory leak" is considered a failure or bug within the application or programme that holds it. Memory leakage may be intended or unintended by the application or program, which may retain the application in memory to execute operations or remain frozen in an unrecoverable state. The resident programme also may source or leak additional memory space without releasing the previously used space, leading to the exhaustion of memory resources and a poorly performing or frozen system. A memory leak may be mitigated through specialised memory management software or by adding garbage collection functions to the application source code.

8. Memory Protection

In computing, an interface is a shared boundary across which two or more separate components of a computer system exchange information. Software, computer hardware, peripheral devices, humans, and combinations of these hardware can all be exchanged. Devices, such as a touchscreen, can both send and receive data through the interface, while others, such as a mouse or microphone, may only provide an interface to send data to a given system. API is the acronym for Application Programming Interface, which is a software intermediary that allows two applications to talk to each other. Each time you use an app like Facebook, send an instant message, or check the weather on your phone, you're using an API. When you use an application on your mobile phone, the application connects to the Internet and sends data to a server. The server then retrieves that data, interprets it, performs the necessary actions, and sends it back to your phone. The application then interprets the data and presents you with the information you wanted in a readable way. This is what an API is. All of this happens via API. To explain this better, let us take a familiar example. Imagine you're sitting at a table in a restaurant with a menu of choices to order from. The kitchen is the part of the system that will prepare your order. What is missing is the critical link to communicate your order to the kitchen and deliver your food back to your table. That's where the waiter or API comes in. The waiter is the messenger or API that takes your request or order and tells the kitchen and system what to do. Then the waiter delivers a response back to you. In this case, it is the food. Here's another real-life example of an API. You may be familiar with the process of searching for flights online. Just like the restaurant, you have a variety of options to choose from, including different cities, departure and return dates, and more. Let's imagine that you're booking your flight on an airline website. You choose a departure city, end date, and return city; an end date, cabin, and class; as well as other variables. In order to book your flight, you interact with the airline's website to access their database and see if any seats are available on those dates and what the costs might be. However, what if you're not using the airline's website, a channel that has direct access to information? What if you're using an online travel service such as Kayak or Expedia, which aggregates information from a number of airline databases? The travel service in this case interacts with the airline API. The API is the interface for that, like your helpful waiter, and can be asked by the online travel service to get information from the airline database to book seats, baggage, options, etc. The API then takes the airline's response to your request and delivers it right back to the online service, which then shows you the most updated, relevant information. What an API also provides is a layer of security. Your phone's data is never fully exposed to the server, and likewise, the server is never fully exposed to your phone. Instead, each communicates with small packets of data, sharing only that which is necessary, like ordering takeout. You tell the restaurant what you would like to eat, they tell you what you need in return, and then in the end, you get your meal. APIs have become so valuable that they comprise a large part of many businesses' revenue. Major companies like Google, Ebay, Salesforce.com, Amazon, and Expedia are just a few of the many companies that make money from their APIs. What the API economy refers to is this marketplace of APIs. Modern APIs have taken on some characteristics that make them extraordinarily valuable and useful. For starters, modern APIs adhere to developer-friendly standards such as HTTP and REST. They're easily accessible and understood broadly. Moreover, they are treated more like products than code. They are designed for consumption by specific audiences, for example, mobile developers. They are documented, and they are versioned in a way that users can have certain expectations of their maintenance and life cycle. And because they are much more standardized, they have much stronger discipline for security and governance, as well as being monitored and managed for performance scale. As with any other piece of productized software, the modern API has its own software development lifecycle, or SDLC, of designing, testing, building, managing, and versioning. Also, modern APIs are well documented for consumption and versioning When discussing interface types, there are two types: physical interfaces and virtual interfaces. Virtual interfaces are network interfaces that are not associated with a physical interface. Physical interfaces have some form of physical element, for example, a RJ-45 male connector on an Ethernet cable. Virtual interfaces exist only in software. There are no physical elements to identify an individual virtual interface using a numerical ID after the virtual interface name, for example, loopback zero or tunnel one. The ID is unique per virtual interface type to make the entire name string unique. For example, both a loop bag zero interface and a null zero interface can exist. But two loopback-zero interfaces cannot exist in a single networking device. Some of the common types of virtual interfaces include loopback interfaces, null interfaces, subinterfaces, and tunnel interfaces. This then begs the question: Why do we need virtual interfaces? And what are the benefits? Well, each type of virtual interface has its own benefit. For example, subinterfaces were invented as a method of virtually subdividing a physical interface into two or more interfaces so that IP routing protocols would see the network connection to each remote networking device as a separate physical layer, even though the subinterfaces share a common physical interface. One of the first uses of sub-interfaces was to solve the problem of the split horizon of frame relay. Wang, a null interface provides an alternative method of filtering without the overhead involved with using access lists. For example, instead of creating an outbound access list that prevents traffic to a destination network from being transmitted out of an interface, You can configure a static route for the destination network that points to the null interface. A loopback interface can provide a stable interface on which you can assign a layer three address, such as an IP or IPX address. This address can be configured as the source address when the networking device needs to send data for protocols to another device in your network. And you want the device receiving the data to always see the same source IP address from the networking device as it relates to interface on vulnerability.Sometimes what happens is that malicious users are able to exfiltrate information from a sensitive system to the outside world through what is known as a covert channel. Covert channels provide a backdoor for communications into or out of the system and allow inadvertent interfaces that weren't planned by software developers to be exploited. There are two types of covert channels. Storage channels communicate by modifying a storage location, such as a hard drive. Timing channels perform operations that affect the total response time observed by the receiver. Three things are required for a covert channel to exist. First, the sender and receiver must have access to a shared resource. Second, the sender must be able to vary some property of the shared resource that the receiver can observe. Finally, the sender and receiver must be able to synchronise their communication. It's apparent that covert channels are extremely common. Probably the only way to completely eliminate the covert channels is to eliminate all shared resources and all communication.

9. Interface Protection

Availability in the context of a computer system refers to the ability of a user to access information or resources in a specified location and in the correct format. Availability is one of the five pillars of information assurance, the other four being integrity, authenticity, education, confidentiality, and nonrepudiation. When a system is regularly non-functioning, information availability is affected and significantly impacts users. In addition, when data is not secure and easily available, information security is affected. Another factor affecting availability is time. If a computer system cannot deliver information efficiently, then availability is compromised. Data availability must be ensured by storage, which may be local or at an offsite facility. In the case of an offsite facility, an established business continuity plan should state the availability of this data. When onsite data is not available at all times, information must be available to those with parents. Availability can generally be improved in one of two manners: high availability or fault tolerance. High availability refers to a system or component that is continuously operational for a desirable length of time. Availability can be measured relative to 100% operational or never failing. A widely held but difficult to achieve standard of availability for a system or product is known five nines," which is 99.99% availability. One example of increasing availability would be power supplies. Power supplies contain moving parts and have high failure rates. By offering a secondary powersource, availability may be increased. RAID is short for redundant array of independent discs. Originally, the term "rate" was defined as a redundant array of inexpensive discs, but now it is usually referred to as a redundant array of independent disks. Raid storage uses multiple discs in order to provide fault tolerance, improve overall performance, and increase the storage capacity in the system. This is in contrast with older storage devices that use only a single disc drive. RAID allows you to store the same data redundantly in a balanced way to improve overall performance. Rate disc drives are common on servers but aren't usually required on personal computers. So how does rating work with Ray Technology? Data can be mirrored on one or more discs in the same array so that if one disc fails, the data is preserved thanks to a technique known as striping, a technique for spreading data over multiple disc drives. Grade also offers the option of reading or writing to more than one disc at the same time. In order to improve performance in this arrangement, sequential data is broken into segments, which are sent to the various discs in the array. Speeding up throughput, a typical RAID array uses multiple discs that appear to be on a single device, so it can provide more storage capacity than a single disk. Raid devices use many different architectures, called levels, depending on the desired balance between performance and fault tolerance. RAID levels describe how data is distributed across the drives. You will need to be familiar with Raid Level One and Rate Level Five. Raid Level One is commonly referred to as "mirroring," where Grade Level Five is commonly referred to as "striping." Let's take a closer look at each. Raid One consists of an exact copy or mirror of a set of data on two or more disks. A classic Raid One mirrored pair contains two disks. Disk configurations offer no parity striping or spanning of the disc space across multiple disks. Since the data is mirrored on all discs belonging to the array and the array can only be as big as the smallest member disk, this layout is useful when read performance or reliability is more important than write performance or the resulting data storage capacity. Raid Five is a rate configuration that uses disc striping with parity. Because data and parity are stripes across all the disks, no single disc has a bottleneck; striping also allows users to reconstruct data in case of disc failure. Reads and writes are more evenly balanced in this configuration, making Raid 5 the most commonly used Raid method. The other method of improving availability is through fault tolerance. Fault-tolerant technology is a capability of a computer system, electronic system, or network to deliver uninterrupted service despite one or more of its components failing. Fault tolerance also resolves potential service interruptions related to software or logic errors. The purpose is to prevent catastrophic failures that could result from a single point of failure. Let's look at a few examples of how we can integrate fault tolerance into a new or existing system. Fault tolerance can include responding to a power failure, which is the lowest level of fault tolerance, by immediately using a backup system in the event of a system failure allowing mirrored discs to take over for a failed disc immediately, and multiple processors working together to compare data and output for errors, then correcting the detected errors immediately

10. High Availability and Fault Tolerance

Every vibrant technology marketplace needs an unbiased source of information on best practices, as well as an active body advocating open standards in the application security space. One of those groups is the Open WebApplication Security Project, or OWASP for short. It operates as a nonprofit and is not affiliated with any technology company, which means it is in a unique position to provide impartial practical information about abstract individuals, corporations, universities, governments, agencies, and other organisations worldwide. Operating as a community of like-minded professionals, OWASP issues software tools and knowledge-based documentation on application security. All of its articles, methodologies, and technologies are made available free of charge to the public. OWASP makes available a list of the top ten most critical web application security risks. Let's take a look at the OAS Top Ten for 2017. If you navigate to OAS.org, you'll see this web page here. I'm going to go ahead and click on OS Top 10; 20; and 17. Now, when we come to this page, this is initially what you'll see. It's a PDF document. I'd like to draw your attention to page six. This page has something that I personally find very interesting. It actually shows you what the application security risks are and the threat agents, the vectors, the actual weaknesses, the security controls that would be used, the technical and business impacts, and the path that it would take. This is actually very helpful to know. The whole document here actually has quite a bit of useful information. But let's go ahead and jump over to Page Seven here, which actually has the list of the top ten security risks for 2017. The top ten security risks are injection, broken authentication, sensitive data exposure, XML, external entities, broken access control, security misconfigurations, cross-site scripting, insecure deserialization components with known vulnerabilities, and insufficient logging and monitoring. Now, we're not going to go through each one of these individually. It would simply be too redundant. Everything is listed here. I would highly encourage you to take a look at this information, and if you feel that you need more information on each one of these, a simple Google search will provide you plenty of information on that. The details of this go well beyond the scope of this course in terms of going into details, but we will look at a few of these in more detail. For example, we will look at SQL injections, and we will also look at cross-site scripting in further detail. If you scroll down this document, you'll notice that each of them is explained. For example, one of the top ten vulnerabilities is injection. It tells you what the threat agent is and the attack vectors, and it goes into quite a bit of detail to provide you with real-world examples. So here's one example here of an attack scenario, and it does the same thing for the other nine vulnerabilities. So now we have broken authentication. It gives you all the details you need. There. same thing with sensitive data exposure. This document is well worth a read. It provides quite a bit of information and is time well spent.

ExamCollection provides the complete prep materials in vce files format which include ISC CISSP certification exam dumps, practice test questions and answers, video training course and study guide which help the exam candidates to pass the exams quickly. Fast updates to ISC CISSP certification exam dumps, practice test questions and accurate answers vce verified by industry experts are taken from the latest pool of questions.