Index_S

S

S/MIME (Secure Multi-Purpose Internet Mail Extensions), 430

SafeBack data recovery software, 309

safeguards against risks, 256, 264-266

sampling, 195

SBU (Sensitive But Unclassified), 149

scanning, 532-535

scans

FIN, 405

port, 403-405

stealth port, 404

SCM applications, 137

scorecards, 212

screened host firewalls, 444

screened subnet firewalls with DMZ, 445

script kiddies, 480

SDLC (System Development Life Cycle), 187

Secret classification, 142

secret key encryption, 333

algorithms for, 333-337

Secure Electronic Transaction (SET), 432

Secure Hash Algorithm (SHA), 338, 339

Secure Hash Standard (SHS), 333

Secure Multi-Purpose Internet Mail Extensions (S/MIME), 430

Secure Shell (SSH), 333, 453

Secure Socket Layer (SSL), 431

security, 110-112

education/documentation, role played in, 235-237

functionality of, certifying, 120

identifying costs, benefits, feasibility for, 153

importance of awareness and, 148-150

lifecycle of, 115-117

management planning for, 150-154

Web browsers and, 536

security administration, 9-12, 101-174

principles of, 103-109

specialty areas of (list), 10

security administrators, separation of duties and, 124

security architecture, 11

security assessments, 153

security audits, 13, 181-190

See also auditing

security checklist audit (exercise), 199-201

security incidents, investigating. See incident investigation

security plan, developing, 152

security policies

corporate information, 146

developing, 152

tools for, 139

security risks

Application layer and, 408

Data Link layer and, 402

Physical layer and, 396

Transport layer and, 403

segregation of duties. See separation of duties

self-synchronizing stream ciphers, 346

Sensitive But Unclassified (SBU), 149

separation of duties, 68, 122-125, 144, 177

vs. principle of least privilege, 122

Serial Line Interface Protocol (SLIP), 435

service identification, 532

Service Level Agreements (SLAs), 120

session hijacking, 458

Session layer, 405

SET Secure Electronic Transaction, 432

SHA (Secure Hash Algorithm), 338, 339

SHA-1, 339

shielded twisted pair (STP), 399

SHS (Secure Hash Standard), 333

SHS hashing algorithm, 333

signaling, 418

signature-based pattern recognition, 213

simple CRLs, 363

single CA models, 364

single keys, 377

Single Loss Expectancy (SLE), 263

Single Sign-On (SSO), 45-47

sites, alternates for business operations, 279

exercise for, 281

SkipJack, 337

slag code, 491

SLAs (Service Level Agreements), 120

SLE (Single Loss Expectancy), 263

SLIP protocol, 435

smart cards, 6

SMEs (subject matter experts), 122

SMT layer, 422

smurf attacks, 516

sniffing, 80-82, 456-458, 528-531

exercise for, 529-531

SNMP exploits, 518

Snoop sniffing tool, 528

snork attacks, 517

Snort sniffing tool, 528

social engineering, 210, 249, 525-527

software configuration management (SCM) applications, 137

software. See tools

something you are authentication, 43, 105

something you have authentication, 42, 105

something you know authentication, 40-42, 105

source routing attacks, 519

spamming, 81

spoofing, 49, 78, 456, 520-522

SSCP certification, 1, 3-28

examination for, 2, 5

SSCP domains, 5-27

SSH (Secure Shell), 333, 453

SSL (Secure Socket Layer), 431

SSO (Single Sign-On), 45-47

stack overflows, 523

standards, 185

star topology, 409-411

stateful inspection, 446

stateful inspection firewalls, overflow attacks and, 524

stealth port scans (SYN scans), 404

steganalysis, 330

steganography, 329

Steganos Security Suite, 330

StegDetect, 330

STP (shielded twisted pair), 399

stream ciphers, 346

study resources, 27

subject matter experts (SMEs), 122

SubSeven trojan, 495

substitution operations, 335

switches, 400, 437

symmetric encryption, 333

symmetric encryption algorithms, 333-337

SYN attacks, 512-514

SYN floods, 459, 513

SYN scans (stealth port scans), 404

synchronization attacks (SYN attacks), 512-514

synchronous ciphers, 346

system accountability, 103

system architecture, access control modes of operation and, 133-135

System Development Life Cycle (SDLC), 187

system events, 195

system high mode, 133, 134

system security architecture, 139-144

Systems Security Certified Practitioner. See SSCP certification