|
|
 |
| Авторизация |
|
|
|
| Поиск по указателям |
|
|
|
|
|
|
|
 |
|
|
|
| Gregg M. — CISA Exam Cram |
|
|
|
| Предметный указатель |
Identity theft 367—368
IDSs 323—324 468
IDSs (Intrusion Detection Systems) 217
IDSs as physical security control 380—381
Implementation phase of SDLC 139—140
Implementing physical security policies 391
Incident classification 406—407 470—471
Incident handling 201
Incident handling, auditing information security 335—336
Incident handling, computer forensics 334—335
Incident handling, delay window 202
Incident handling, emergency response 332—334
Incident handling, responding to incidents 330—332
incremental backups 432
Incremental development 142 456
Independence of auditor, necessity of 40
Indicators of fraud 49
Influence organizational form 119
Information assets, classifying 296—297
Information assets, evaluating 296
Information classification methods 392—394
Information security governance, funding 73
Information systems control 37 449—450
Information systems control, audits 41
Information systems control, maintenance practices 146
Information systems control, sourcing 93
Information systems control, sourcing, SLAs 95—96
Infrastructure security, auditing 337
Infrastructure security, auditing, change management 339—340
Infrastructure security, auditing, network assessments 339
Infrastructure security, auditing, penetration testing 337—339
input controls 160—162
Integrated auditing 51—52
Integrity, role in IS 295—296
Integrity-based data classification system 297
interface testing 137
Interior controls for physical security 375
Interior controls for physical security, doors 375—376
Interior controls for physical security, locks 377—378
Interior controls for physical security, walls 377
Interior controls for physical security, windows 376
Internal controls, general control procedures 37
Internet layer (TCP/IP model) 250—252
Internet, CGI 273
Internet, cookies 273
Internet, development of 272
Internet, firewalls 321—322
Internet, Java 273
Internet, privacy issues 273
Internet, URLs 272
Interoffice communication, securing 392
interpreters 222 463
Interruptions, types of 418
IOCE (International Organization of Computer Evidence) 335
IP (Internet Protocol) 247
IPSec (IP Security) 350
IPSs (intrusion prevention systems) 217 324
IPv6 251
IS operations, change-management process 206—207
IS operations, change-management process, post-deployment 209
IS operations, change-management process, program library systems 207—208
IS operations, change-management process, release management 208—209
IS operations, help desk and support 204—206
IS operations, resource monitoring, keystroke monitoring 200
IS operations, resource usage, monitoring 200
IS operations, resource usage, monitoring, abnormal events, tracking 202—203
IS operations, resource usage, monitoring, incident handling 201
IS operations, resource usage, monitoring, problem management 202
IS security steering committee 295
ISA (Industry Standard Architecture) bus 213
ISACA (Information Systems Audit and Control Association) 38
ISACA (Information Systems Audit and Control Association), auditing standards 28—29
ISACA (Information Systems Audit and Control Association), auditing standards, code of ethics 31
ISACA (Information Systems Audit and Control Association), auditing standards, guidelines 29—30
ISACA (Information Systems Audit and Control Association), auditing standards, procedures 30—31
ISACA (Information Systems Audit and Control Association), auditing standards, website 30
ISDN 268
ISO (International Organization for Standardization) 244
ISO (International Organization for Standardization), OSI reference model See OSI reference model
ISO 17799 76
ISO 9001 certification 96
ISPs 272
IT governance 67 99
IT governance, asset identification 81—83
IT governance, auditor's role in 69
IT governance, best practices, goals of 67—68
IT governance, bottom-up policy development 451
IT governance, change management 95
IT governance, CobiT 454
IT governance, documentation, reviewing 78—79
IT governance, employee management 89
IT governance, employee management, employee handbooks 90
IT governance, employee management, hiring practices 89—90
IT governance, employee management, termination procedures 92
IT governance, employee management, training 91
IT governance, employee roles 100—101
IT governance, employee roles, segregation of duties 101—103
IT governance, guidelines 78
IT governance, information security governance, funding 73
IT governance, performance, measuring 71—72
IT governance, policies 76—77
IT governance, procedures 77
IT governance, quality management 96—98
IT governance, quality management, CobiT 98
IT governance, quality management, COSO 99
IT governance, quality management, ERP 98
IT governance, risk assessment, qualitative 87—88
IT governance, risk assessment, quantitative 83—86
IT governance, risk management 79—80
IT governance, sourcing 93
IT governance, sourcing, SLAs 95—96
IT governance, standards 78
IT governance, steering committee 70
IT governance, threat identification 81
IT governance, top-down policy development 75—77 451
IT steering committee 70
ITF (integrated test facilities) 47
ITGI (IT Governance Institute) 38
Java 222 273
JBOD (Just a Bunch of Disks) 431
Kaplan, Robert 71
Kerberos 308—309
Kernel mode (CPU) 211
Kernel proxy 321 468
Key roles in logical security 295—296
Key verification 94
Keys, bump keys 379
Keystroke monitoring 200
Kilby, Jack 212
Kitchen sink syndrome 136
KLOC (kilo lines of code) 123
Knowledge-driven DSS 184
Known plain-text attacks 351
LANs (local area networks) 243
LANs (local area networks), security 325
laptops 215
latency 274
Layer 1 See physical layer (OSI reference model)
Layer 2 See data-link layer (OSI reference model)
Layer 3 See network layer (OSI reference model)
Layer 4 See transport layer (OSI reference model)
Layer 5 See session layer (OSI reference model)
Layer 6 See presentation layer (OSI reference model)
Layer 7 See application layer (OSI reference model)
Layered approach to physical security controls 371
Layers of OSI reference model, application layer 246
Layers of OSI reference model, data link layer 247
Layers of OSI reference model, network layer 247
Layers of OSI reference model, physical layer 247
Layers of OSI reference model, presentation layer 246
| Layers of OSI reference model, session layer 246
Layers of OSI reference model, transport layer 246
Layers of system-access controls 299—300
Layers of TCP/IP model, application layer 253—254
Layers of TCP/IP model, host-to-host layer 252—253
Layers of TCP/IP model, internet layer 250—252
Layers of TCP/IP model, network access layer 250
Legislation, Safe Harbor Act 24
Legislation, SOX 40
Legislation, verifying compliance with external regulations 25—26
Lifecycle management, alternative applicationdevelopment techniques 142—145
Lifecycle management, business application development 130—131
Lifecycle management, business application development, systems-development methodology 131—132
Lifecycle management, project management 117
Lifecycle management, project management, key roles 118
Lifecycle management, project management, project control and execution 128
Lifecycle management, project management, project culture and objectives 119—120
Lifecycle management, project management, project initiation 121
Lifecycle management, project management, project organizational forms 119
Lifecycle management, project management, project planning 121—128
Lifecycle management, project management, projects, closing 128—129
Lighting as physical security control 374
Lights-out operations 200
Link-state routing protocols 252
load balancers 217
Locks, as physical security control 376—378
Locks, durability of 378
Locks, picking, methods of 378
Locks, scrubbing 379
Locks, tubular 377
Locks, tumbler locks 377
Locks, warded locks 377
Logging as logical access control 311—312
Logical access controls 303
Logical access controls, attacks, active 314—319
Logical access controls, attacks, passive 313—314
Logical access controls, auditing and logging 311—312
Logical access controls, I&A process 303
Logical access controls, I&A process, authentication by characteristic 306—307
Logical access controls, I&A process, authentication by knowledge 304—305
Logical access controls, I&A process, authentication by ownership 305
Logical access controls, remote-access security 309—311
Logical access controls, single sign-on 307—309
Logical bombs 316
Logical security, goals of 294
Logical security, IS protection mechanisms 294—295
Logical security, key roles 295—296
Logical security, network infrastructure, firewalls 321—322
Logical security, network infrastructure, IDSs 323—324
Logical security, on client/server networks 324—325
Logical security, on LANs 325
Logical security, on wireless LANs 326—328
Low-key building design as physical security control 374
MAC (mandatory access control) 302 466
MAID (Massive Array of Inactive Disks) 432
Mainframes 215
Major releases 208 461
MAN (metropolitan area network) 243
man-in-the-middle attacks 351
Man-made physical security vulnerabilities 366—367
Man-made physical security vulnerabilities, sources of attacks 370—371
Manual authorization controls 160
Masquerading 318
Material risks 36
McCarty, Eric 172
measuring performance 71—72
Media rotation 433
Memory 212
Memory, ROM 462
Memory, secondary storage 212 224
mesh topology 255
Metadata 226
Metcalfe, Robert 243
MIB (management information base) 275
Military data-classification system 297
Minor releases 208 461
Mitigating risks 34 448
Mobile sites 426
Model-driven DSS 184
modems 260
Monitoring, hardware 219
Monitoring, resource usage 200
Monitoring, resource usage, abnormal events, tracking 202—203
Monitoring, resource usage, incident handling 201
Monitoring, resource usage, problem management 202
Monitoring, risks 35
MPLS (Multiprotocol Label Switching) 267
MTBF (Mean Time Between Failures) 429
MTD (maximum tolerable downtime) 426
MTTR (mean time to repair) 430
Multicast transmission 251
Multiple encryption 343
Multiprocessor CPUs 211 461
Multiprogramming CPUs 210 461
Multitasking CPUs 210 461
NAT (Network Address Translation) 266 322
National access points 272
Naturally occurring physical security vulnerabilities 365—366
NDMS (network database-management systems) 464
NDMSs (network database-management systems) 227
Network access layer (TCP/IP model) 250
Network administration, help desks 274
Network administration, SNMP 275
Network analysis 314
Network infrastructure, controls 319—320
Network infrastructure, firewalls 321—322
Network infrastructure, IDSs 323—324
Network infrastructure, physical controls, verifying 276
Network infrastructure, pre-deployment considerations 258
Network layer (OSI reference model) 247
Network protection methods 434—435
network services 248—249
network sniffers 313
Networks, devices 465—466
Networks, elements of 462—463
networks, topologies 465
Neural IDS detection 323 469
NIDS (network-based intrusion detection systems) 323
Noncritical systems 472
Nonstatistical sampling 46
Norton, David 71
NSPs 272
Objectives of audit, defining 45
OBS (object breakdown structure) 120
OFDM (orthogonal frequency-division multiplexing) 270
Off-site storage 433
On-site storage 433
Online UPS systems 383
OOSD (object-oriented systems development) 145
Operational audits 41
organization of book 6—7
Organizational framework of projects 119
OSI reference model 244
OSI Reference Model, Application Layer 246
OSI Reference Model, Data Link Layer 247
OSI Reference Model, Network Layer 247
OSI Reference Model, Physical Layer 247
OSI Reference Model, Presentation Layer 246
OSI Reference Model, Session Layer 246
OSI Reference Model, Transport Layer 246
OSI reference model, versus TCP/IP model 249
OSs (operating systems) 223
OSs (operating systems), supervisory mode 224
OSSTMM (Open Source Security Test Methodology Manual) 338
Output controls 166—167 459
packet filtering 263—264 321 468
Packet-switched WANs 267—268
PAN (Personal Area Network) 243
Paper testing 423 473
Parallel simulation 47
|
|
|
| Реклама |
|
|
|
|
|
О проекте