The cybersecurity body of knowledge : the ACM/IEEE/AIS/IFIP recommendations for a complete curriculum in cybersecurity / Dan Shoemaker, Anne Kohnke, and Ken Sigler.

Format:

Book

Author/Creator:

Shoemaker, Dan, author.

Kohnke, Anne, author.

Sigler, Kenneth, author.

Series:

Internal audit and IT audit.

Internal audit and IT audit

Language:

English

Subjects (All):

Computer security--Study and teaching.

Computer security.

Physical Description:

1 online resource (615 pages).

Edition:

1st ed.

Place of Publication:

New York, NY : CRC Press, [2020]

Summary:

"This book explains the content, purpose and use of the eight standard knowledge areas that constitute the emerging discipline of cybersecurity. It captures and explains that body of knowledge, to provide teachers and students with a complete picture of the field at a suitable depth of understanding"-- Provided by publisher.

Contents:

Cover

Half Title

Series Page

Title Page

Copyright Page

Table of Contents

Foreword 1

Foreword 2

Author Biographies

Introduction

Chapter 1 Securing Cyberspace is Every Body's Business

Introduction: The Current Situation Is Out of Control

The Challenge: How Do You Protect Something that Doesn't Actually Exist?

We Must Re-evaluate Our Assumptions

The Adversary Changes Things

The Three-Legged Stool

Learning to Play Better with Others

Creating a Holistic Solution

The Importance of Knowing What to Do

Enabling Common Understanding

Education Is the Key

The Body of Knowledge and Educational Strategy

Cybersecurity as an Academic Study

The Association for Computing Machinery (ACM)

The International Society of Electrical and Electronic Engineers (IEEE)

The Association for Information Systems (AIS)

The International Federation for Information Processing (IFIP)

The Importance of Unified Recommendations about Areas of Vital Interest

Circumscribing the Field: Background and Intention of CC2005

Defining the Elements of the Discipline of Cybersecurity: CSEC2017

Knowledge Area One: Data Security

Knowledge Area Two: Software Security

Knowledge Area Three: Component Security

Knowledge Area Four: Connection Security

Knowledge Area Five: System Security

Knowledge Area Six: Human Security

Knowledge Area Seven: Organizational Security

Knowledge Area Eight: Societal Security

Real-World Utilization of the CSEC2017 Body of Knowledge

CSEC2017 Framework Areas of Application

Thirty Review Questions: Introduction to the CSEC Standard

You Might Also Like to Read

Chapter Summary

Keywords

References

Chapter 2 The Cybersecurity Body of Knowledge

Bodies of Knowledge are Essential Tools in Educational Settings

Bodies of Knowledge.

Making Cybersecurity Teaching Real

Validating Curricular Concepts

Applying the CSEC2017

The CSEC2017 Model

The CSEC2017 Organization

The CSEC2017 Implementation Process

Twenty Review Questions: The Cybersecurity Body of Knowledge

Chapter 3 Data Security

Surviving in a Digital Era

The CSEC2017 Data Security Knowledge Units

Knowledge Unit One: Cryptography

Basic Concepts

Advanced Concepts

Mathematical Background

Historical Ciphers

Symmetric (Private Key) Ciphers

Asymmetric (Public Key) Ciphers

Knowledge Unit Two: Digital Forensics

Legal Issues

Digital Forensics Tools

Investigatory Processes

Acquisition and Preservation of Digital Evidence

Analysis of Evidence

Presentation of Results

Authentication of Evidence

Reporting, Incident Response, and Handling

Mobile Forensics

Knowledge Unit Three: Data Integrity and Authentication

Authentication Strength

Password Attacks

Password Storage Techniques

Data Integrity

Knowledge Unit Four: Access Control

Physical Data Security

Logical Data Access Control

Secure Architecture Design

Data Leak Prevention

Knowledge Unit Five: Secure Communication Protocols

Application and Transport Layer Protocols

Attacks on Transport Layer Security

Internet/Network Layer

Privacy Preserving Protocols

Data Link Layer

Knowledge Unit Six: Cryptanalysis

Classical Attacks.

Side-Channel Attacks

Attacks against Private Key Ciphers

Attacks against Public Key Ciphers

Algorithms for Solving the Discrete Log Problem

Attacks on RSA

Knowledge Unit Seven: Data Privacy

Knowledge Unit Eight: Information Storage Security

Disk and File Encryption

Data Erasure

Data Masking

Database Security

Data Security Law

Chapter Review Questions

Learning Objectives for the Data Security Knowledge Area

Chapter 4 Software Security

Building Pathways toward Software Security

The CSEC2017 Software Security Knowledge Units

Knowledge Unit One: Fundamental Principles

Least Privilege

Fail-Safe Defaults

Complete Mediation

Separation of Duties

Minimize Trust

Economy of Mechanism

Minimize Common Mechanism

Least Astonishment

Open Design

Layering

Abstraction

Modularity

Complete Linkage

Design for Iteration

Knowledge Unit Two: Design

Derivation of Security Requirements

Specification of Security Requirements

Software Development Life Cycle/Security Development Life Cycle

Programming Languages and Type-Safe Languages

Knowledge Unit Three: Implementation

Validating Input and Checking Its Representation

Using API's Correctly

Using Security Features

Checking Time and State Relationships

Handling Exceptions and Errors Properly

Programming Robustly

Encapsulating Structures and Modules

Taking Environment into Account

Knowledge Unit Four: Analysis and Testing

Static and Dynamic Analysis

Unit Testing

Integration Testing

Software Testing

Knowledge Unit Five: Deployment and Maintenance

Configuring

Patching and the Vulnerability Life Cycle

Checking Environment

DevOps

Decommissioning and Retiring

Knowledge Unit Six: Documentation.

Installation Documents

User Guides and Manuals

Assurance Documentation

Security Documentation

Knowledge Unit Seven: Ethics

Ethical Issues in Software Development

Social Aspects of Software Development

Legal Aspects of Software Development

Vulnerability Disclosure

What, When, and Why to Test

Twenty Review Questions for This Chapter

Learning Objectives for the Component Security Knowledge Area

Reference

Chapter 5 Component Security

It All Starts with the Components

The CSEC2017 Component Security Knowledge Units

Knowledge Unit One: Component Design

Component Design Security

Principles of Secure Component Design

Component Identification

Anti-reverse Engineering Techniques

Side Channel Attack Mitigation

Anti-tamper Technologies

Knowledge Unit Two: Component Procurement

Supply Chain Risks

Supply Chain Security

Supplier Vetting

Knowledge Unit Three: Component Testing

Principles of Unit Testing

Security Testing

Stress Testing

Fuzz Testing

Penetration Tests

Knowledge Unit Four: Component Reverse Engineering

Design Reverse Engineering

Hardware Reverse Engineering

Software Reverse Engineering

Forty Review Questions: Component Security

Chapter 6 Connection Security

Introduction: The Challenge of Connecting the Enterprise

The CSEC Connection Security Knowledge Areas

Knowledge Unit One: Physical Media

Transmission in a Medium

Shared and Point-to-Point Media

Sharing Models

Common Technologies

Knowledge Unit Two: Physical Interfaces and Connectors

Hardware Characteristics and Materials

Standards

Common Connectors.

Knowledge Unit Three: Hardware Architecture

Standard Architectures

Hardware Interface Standards

Common Architectures

Knowledge Unit Four: Distributed Systems Architecture

Network Architectures, General Concepts

World Wide Web

The Internet

Protocols and Layering

High Performance Computing (Supercomputers)

Hypervisors and Cloud Computing Implementations

Vulnerabilities

Knowledge Unit Five: Network Architecture

General Concepts

Forwarding

Routing

Switching/Bridging

Emerging Trends

Virtualization and Virtual Hypervisor Architecture

Knowledge Unit Six: Network Implementations

IEEE 802/ISO Networks

IETF Networks and TCP/IP

Practical Integration and Glue Protocols

Vulnerabilities and Example Exploits

Knowledge Unit Seven: Network Services

Concept of a Service

Service Models (Client-Server, Peer to Peer)

Service Protocols and Concepts (IPC, APIs, IDLs)

Common Service Communication Architectures

Service Virtualization

Knowledge Unit Eight: Network Defense

Network Hardening

Implementing Firewalls and Virtual Private Networks (VPNs)

Defense in Depth

Honeypots and Honeynets

Network Monitoring

Network Traffic Analysis

Minimizing Exposure (Attack Surface and Vectors)

Network Access Control (Internal and External)

Perimeter Networks/Proxy Servers

Network Policy Development and Enforcement

Network Operational Procedures

Network Attacks

Threat Hunting and Machine Learning

Twenty Review Questions: Connection Security

Learning Objectives for the Connection Security Knowledge Area

Chapter 7 System Security

Assembling the Parts into a Useful Whole

The Key Role of Design in Systems.

The CSEC2017 System Security Knowledge Units.

Notes:

"An Auerbach Book" -- Title page.

Includes bibliographical references and index.

Description based on print version record.

ISBN:

1-00-302259-6

1-000-05041-6

1-000-05039-4

1-003-02259-6

9781003022596

OCLC:

1150823803