SSCP: Systems Security Certified PractitionerDemo

PGP encrypts the actual message data with a symmetric encryption algorithm because it is efficient for bulk data. The symmetric session key is subsequently protected using asymmetric cryptography.

Backup and recovery, contingency planning, and operating procedures are operational activities used to run, maintain, and restore systems. Auditing is an independent examination of records and activities to assess compliance and the adequacy of controls, rather than an operational control itself.

Network security protocols, network authentication services, and data encryption services are telecommunications elements used to protect confidentiality. Passwords are authentication credentials rather than a telecommunications confidentiality service. NIST likewise distinguishes confidentiality from authentication as separate OSI security services.

The data or information owner is accountable for classifying information and establishing the protection requirements and controls appropriate to its sensitivity and criticality. NIST defines an information owner as the official responsible for establishing controls for an information’s generation, classification, collection, processing, dissemination, and disposal.

A data backup is the essential first recovery safeguard because contingency operations require a recoverable copy of the organization’s information. Backups of firmware, operating systems, and applications may support rebuilding systems, but they do not protect the business data that must be restored.

Communications security management and techniques protect networked transactions by applying controls that prevent, detect, and correct errors while preserving confidentiality, integrity, and availability.

Policies are high-level statements that establish an organization’s beliefs, goals, objectives, and overall direction. Standards, guidelines, and procedures translate that direction into more specific requirements or actions.

Legal liability may arise when an organization fails to implement a safeguard whose cost is lower than the anticipated loss from the related vulnerability. In that circumstance, the protection is economically justified and its omission may be viewed as a failure to exercise reasonable care.

Mandatory access control bases access decisions on centrally assigned security classifications or sensitivity labels and the user’s authorized clearance.

HMAC, CBC-MAC using a block cipher such as DES, and UMAC are established MAC constructions. Digital signatures use asymmetric cryptography and are distinct from MACs; “signature-based MAC (SMAC)” is not a standard MAC type.

Corrective controls remediate a problem after it occurs and restore affected systems, processes, or controls to an acceptable operating state.

Change control evaluates and manages requested changes by analyzing reported problems, estimating their cost or effort, and setting request priorities. Designing the interface presented to the user is ordinarily a subsequent design and implementation activity after a change is approved.

Disaster recovery is a core business-continuity investment that protects operations, data, and organizational resilience; it should not be treated as an optional or discretionary expense.

Role-Based Access Control assigns permissions according to the role an individual holds in the organization, reflecting the functions and responsibilities associated with that role. A single role can apply to one or multiple individuals.

Badges, locks, and security guards control entry to physical locations or assets. Passwords authenticate access to systems or accounts, making them a logical rather than physical access control.

CSMA/CD is the shared-media Ethernet access method that detects a collision caused by simultaneous transmissions, stops transmission, and uses a backoff process before retrying.

Routers forward packets between distinct networks based on Layer 3 logical addressing and routing information. Therefore, they operate at the Network layer.

Discretionary, mandatory, and lattice-based access control are established access-control models. “Relevant Access Controls” is not a recognized access-control technique.

Fiber-optic cabling carries data as light rather than electrical signals, does not emit electromagnetic radiation, and generally requires physical intrusion into the cable to intercept traffic. This makes it more resistant to tapping than microwave, twisted-pair, or coaxial media.

A one-way hash supports integrity verification by allowing a recipient to detect whether data changed, but it does not by itself provide authentication. Authentication requires proof of origin, such as a keyed hash (HMAC) or a digital signature.

Identification and authentication controls address user authorization, password management, and the disabling of inactive user IDs. A process for reporting incidents is an incident-management control rather than an identification and authentication control.

A digital timestamp provides time-based evidence that a document existed at a particular point in time, binding that document to the recorded time.

The Clark-Wilson model permits authorized users to modify information through authorized, controlled procedures. Its integrity objectives concern preventing unauthorized changes and preserving internal and external consistency, not preventing every modification by authorized users.

Competitive intelligence attacks seek information that can provide an organization with a competitive or commercial advantage. Their underlying motive is business-related.