MTD, RTO, RPO & SLA

Maximum Tolerable Downtime (MTD) = 

                                        Recovery Time Objective (RTO)  + Work Recovery Time (WRT)

Kerberos

Kerberos is named after 3-headed dog in Greek mythology.

It is a single sign on protocol to provide authentication service on network.

It is a must study protocol for CISSP exam and it is almost guaranteed topic with quiet a few questions about the protocol, mainly in Domain 5: Identity and Access Management (IAM)

Secure LDAP

LDAP by default is not really secure.

Default ports are 389 & 3268 - 3268 is for Global Catalog.

A common alternative method of securing LDAP communication is using an SSL tunnel. 

The default port for LDAP over SSL is 636.

Global Catalog is available by default on ports 3268, and 3269 for LDAPS.

Authentication Factors

Common authentication factors are the following types:

• Type 1: What you know, e.g passwords and pin numbers
• Type 2 - What you have, e.g. token cards and smart cards
• Type 3 - What you are, e.g. biometrics

There are also the following types:

• Somewhere you are, e.g. your IP address or Caller ID
• Context-Aware, e.g. what MDM systems use to identify mobile user such as gelocation, time of the day. 

Mandatory Vacation

Mandatory vacation is one of methods to detect fraud. One or two weeks of vacation can be used to audit work tasks of an employee and expose ongoing frauds. 

This is an important fact to know for CISSP test. One may be asked what is the shortest time needed. A week is the minimum. Two weeks is preferred and more effective. 

Fair Cryptosystem - Key Escrew

This is when you split the key among 2 or more parties in order for them to keep the portions of the key in escrow so that, under certain circumstances, an authorized third party may gain access to those keys. For further details ref to https://en.wikipedia.org/wiki/Key_escrow

NIST 800-53A

NIST 800-53A is a special publication which provides a set of procedures for conducting assessments of security controls and privacy controls employed within federal information systems and organizations.

This can be a topic of CISSP questions. So it is important to remember this special publication and its intent.

NIST 800-137 Steps

Steps in NIST 800-137 Special Publication can be part of a CISSP exam question.

Overall, the Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

NIST 800-137 covers Information Security Continuous Monitoring (ISCM) for Federal Information
Systems and Organizations and includes the following steps to establish, implement, and maintain ISCM:

• Define an ISCM strategy;
• Establish an ISCM program;
• Implement an ISCM program;
• Analyze data and Report findings;
• Respond to findings; and
• Review and Update the ISCM strategy and program. 

IT Protocols for Auditing

Examples of protocols used for auditing are:

• COBIT (Control Objectives for Information and Related Technologies) is a framework created by ISACA for information technology (IT) management and IT governance.
• SSAE-16
• ISO27002

but not ITIL.
ITIL is best practices guide for IT service management developed by UK Cabinet Office.

RFC 1918 - non-routable private IP Address Ranges

RFC 1918 private and non-routable IP address ranges are:

24-bit block	10.0.0.0 – 10.255.255.255	8 bits
20-bit block	172.16.0.0 – 172.31.255.255	12 bits
16-bit block	192.168.0.0 – 192.168.255.255	16 bits

The above are IP addresses which can not be scanned or reached from outside an organisation for pen testing etc. 

Network Flow Logging

Flows, also known as network flows, are logs captured to provide insight to network traffic for security, performance and troubleshooting purposes.

This phrase or topic may come in a  question to be confused with other types of logging:

• Audit logging: logs events on a router, PC etc. 
• Trace logging: used for application.

or some other made up terms such as route logging! 

Tools for Testing & scanning

Open source:

• OpenVAS: Vulnerability scanning tool. 
• nmap: The network mapper, a good tool to scan ports etc.  
• Nikto: Vulnerability scanner - Unix like command line tool 

Commercial: 

• Microsoft Baseline Security Analyzer (MBSA): discontinued! Tool to determine security state by assessing missing security updates and less-secure. Security updates are determined by the current version of MBSA using the Windows Update Agent present on Windows computers since Windows 2000 Service Pack 3. 
• Nessus: Vulnerability scanner. Nessus was open source before but no longer. 

Generational Versus Mutation Fuzzing Methods

As part of one of CISSP question, one may come across different ways of fuzzing.

There are 2 types of generating input data for fuzzing:

1. Generational method
• Generational fuzzes input data based on data models and how an application uses data to test the application.  
2. Mutational method
• Mutation method simply mutates the valid sample input data. This method is also known as "dumb" fuzzing method.

Interface Testing

Well explained in guru99 page here:

https://www.guru99.com/interface-testing.html

The page states:

What is Interface Testing?

Interface Testing is defined as a software testing type which verifies whether the communication between two different software systems is done correctly.

Note the keywords "communication" and between different software systems, which may have been separately developed software modules.