Free CISSP Practice Test Questions and Answers (2026)

The matching aligns each access control model with its defining characteristic.

• Mandatory Access Control (MAC) is a centralized model where a system authority enforces access based on security labels (e.g., clearances and classifications). The owners or end users of objects do not have the authority to change these access rules.
• Discretionary Access Control (DAC) is a decentralized model where the owner (a subject) of a resource (an object) has the discretion to grant or deny access to other subjects. This gives the subject total control over the objects they own.
• Role Based Access Control (RBAC) simplifies administration by assigning permissions to roles that correspond to job functions. Users are then assigned to these roles, inheriting the associated permissions necessary for their duties.
• Rule-based access control uses a set of configurable rules or criteria to make access decisions. The specific scenario described—dynamically assigning roles based on criteria—is a form of rule-based logic applied to an RBAC framework, often seen in modern identity management systems.

National Institute of Standards and Technology (NIST). (2017). NIST Special Publication 800-192: Verification and Test Methods for Access Control Policies/Models. Section 2.1, "Access Control Policies/Models Definitions". This document defines MAC as non-discretionary and DAC as allowing owners to specify access. DOI: https://doi.org/10.6028/NIST.SP.800-192

National Institute of Standards and Technology (NIST). (n.d.). Glossary: Role-Based Access Control. Computer Security Resource Center. Retrieved from https://csrc.nist.gov/glossary/term/role_based_access_control. This source defines RBAC as being "based on user roles...Role permissions may be inherited through a role hierarchy and typically reflect the permissions needed to perform defined functions within an organization."

Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. Chapter 4, "Access Control". This textbook provides foundational academic descriptions, explaining that with DAC, "an entity may be granted access rights that enable the entity, by its own volition, to enable another entity to access some resource" (p. 116), whereas with MAC, controls are "not subject to the object owner's discretion" (p. 120).

Hu, V. C., Ferraiolo, D., Kuhn, R., Friedman, A. R., Lang, A. J., et al. (2013). Guide to Attribute Based Access Control (ABAC) Definition and Considerations. NIST Special Publication 800-162. Section 2.3.4 discusses how ABAC (a form of rule-based control) can be used to implement dynamic role assignment, stating, "In some cases the subject's assigned role...may be determined dynamically from subject attributes." This directly supports the match for rule-based access control. DOI: https://doi.org/10.6028/NIST.SP.800-162

The question asks to identify the value comparison that accurately reflects the agile development approach. The Agile Manifesto outlines four core values that prioritize certain aspects of software development over others. The second value stated in the manifesto is "Working software over comprehensive documentation." This emphasizes the delivery of functional, valuable software to the end-user as the primary measure of progress, rather than the creation of extensive documentation which was common in traditional, plan-driven models like the Waterfall methodology. The other options present inverted versions of the remaining three agile values.

1. Beck

K.

Beedle

M.

van Bennekum

A.

Cockburn

A.

Cunningham

W.

Fowler

M.

Grenning

J.

Highsmith

J.

Hunt

A.

Jeffries

R.

Kern

J.

Marick

B.

Martin

R. C.

Mellor

S.

Schwaber

K.

Sutherland

J.

& Thomas

D. (2001). Manifesto for Agile Software Development. AgileManifesto.org. Retrieved from https://agilemanifesto.org/. The document explicitly states the four core values

including "Working software over comprehensive documentation."

2. Fox

A.

& Patterson

D. (2015). CS 169: Software Engineering

Lecture 2: Agile/XP. University of California

Berkeley

EECS Department. Slide 11

"Agile Manifesto

" directly quotes the four values

confirming that options A

B

and C are inversions of the stated principles.

3. Abrahamsson

P.

Salo

O.

Ronkainen

J.

& Warsta

J. (2002). Agile software development methods: Review and analysis. VTT Publications 478. Section 3.1

"The Agile Manifesto

" p. 19

lists and discusses the four values

corroborating that "Working software over comprehensive documentation" is a core tenet.

The deployment phase of establishing a vulnerability management program focuses on implementing the designed program and making it operational. A fundamental task in this phase is to select, procure, and configure the necessary supporting technologies, such as vulnerability scanners, patch management systems, and ticketing systems. These tools form the technical foundation of the program, and their deployment is a prerequisite for subsequent operational activities like scanning, analysis, and remediation.

1. Carnegie Mellon University

Software Engineering Institute (CMU/SEI). In the technical note "A Framework for a Vulnerability Management Program

" the authors state

"The selection of tools is a critical step in the implementation of a vulnerability management program." The deployment phase is synonymous with the implementation phase

where the planned program is put into action.

Source: Alberts

C.

& Dorofee

A. (2005). A Framework for a Vulnerability Management Program (CMU/SEI-2005-TN-028). Carnegie Mellon University. (See Section 3.3

"Tool Selection").

2. NIST Special Publication 800-100

"Information Security Handbook: A Guide for Managers." This guide outlines the information security program life cycle

which includes initiation

development/acquisition

implementation

operation/maintenance

and disposal. The selection and procurement of technologies fall squarely within the "development/acquisition" phase

which directly precedes the "implementation" (or deployment) phase. In the context of establishing a new program

these are often grouped as deployment activities.

Source: NIST SP 800-100

Chapter 3

"Information Security Program Management

" Section 3.3

"Information Security Program Life Cycle."

3. University of California

Berkeley

Information Security Office. Courseware and guidance on establishing security programs consistently place budgeting and charter development in the initial "Strategy & Plan" phase

while tool acquisition and implementation occur in the "Build/Deploy" phase. Measuring metrics occurs in the final "Measure & Improve" phase.

Source: UC Berkeley Security

"Vulnerability Management Program

" Program Development Lifecycle documentation. (Illustrates the standard phased approach to program creation).

Software security functional requirements must be defined early in the Software Development Life Cycle (SDLC) to ensure security is built-in, not bolted on. This process logically follows the initial analysis of the system's purpose and the data it will handle. First, the business functional analysis determines what the system needs to do. Second, data security categorization (e.g., per FIPS 199) assesses the sensitivity of the information being processed. Only after understanding both the system's function and the data's value can appropriate and specific security requirements (e.g., access controls, encryption levels) be defined. This "shift left" approach is fundamental to secure systems engineering.

1. NIST Special Publication 800-64 Revision 2

Security Considerations in the System Development Life Cycle.

Section 2.1

Initiation Phase: This section states

"During the Initiation Phase

the need for a system is expressed and the purpose of the system is documented... Security requirements should be identified and discussed at this early stage." It explicitly links the initial business need and the security categorization (based on FIPS 199) as precursors to defining these requirements.

2. NIST Special Publication 800-160 Volume 1

Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems.

Section 2.3.2

Stakeholder Needs and Requirements Definition Process: This section describes the process to "define the stakeholder requirements for a system." It emphasizes that this occurs at the beginning of the life cycle to capture all needs

including security

which are derived from the business or mission objectives and the required level of protection for assets.

3. Federal Information Processing Standards Publication (FIPS) 199

Standards for Security Categorization of Federal Information and Information Systems.

Section 3

Categorizing Information and Information Systems: This standard establishes the importance of categorizing information based on confidentiality

integrity

and availability impacts. This categorization is a foundational step in the risk management process and directly informs the selection of security controls and requirements early in the SDLC.

A Cost-Benefit Analysis (CBA) is a fundamental financial process used in risk management to evaluate the viability of a security initiative. It directly compares the monetary cost of implementing and maintaining a control against its projected financial benefit. This benefit is typically measured as the reduction in risk, often quantified by the decrease in the Annualized Loss Expectancy (ALE). The final output of a CBA is a data-driven, financial argument (e.g., Return on Security Investment - ROSI) that provides a quantifiable justification for management to decide whether to approve the expenditure. It translates a technical security requirement into a business-centric financial decision.

1. National Institute of Standards and Technology (NIST). (2012). Guide for Conducting Risk Assessments (NIST Special Publication 800-30

Revision 1).

Section 3.3.3

Analysis of Alternatives: This section describes the process of evaluating different courses of action for risk response. It states that organizations should "evaluate the relative advantages and disadvantages (e.g.

effectiveness

feasibility

cost-benefit) of the alternative courses of action." This highlights that the CBA is the tool for providing a justifiable comparison.

2. Gordon

L. A.

& Loeb

M. P. (2002). The Economics of Information Security Investment. ACM Transactions on Information and System Security

5(4)

438–457. https://doi.org/10.1145/581271.581274

Page 440: The paper introduces an economic model for information security investment

stating

"The model shows how the optimal amount to invest in information security is an increasing function of the vulnerability of the information to security breaches." The entire premise is to provide a quantifiable

economic justification for security spending

which is the core of a CBA.

3. Van Oorschot

P. C. (2020). Computer Security and the Internet: Tools and Jewels. Springer.

Chapter 10

Section 10.2.2

Risk Analysis: This section discusses quantitative risk analysis

explaining that the goal is to assign monetary values to assets and the impact of threats. It notes that the results

such as the ALE

are used in a cost-benefit analysis to "justify the cost of countermeasures." This directly supports that the result of a CBA is justification.

A Tier 4 data center is defined by the Uptime Institute as having "Fault Tolerant Site Infrastructure." This means it has 2N+1 fully redundant infrastructure for power, cooling, and network connectivity, ensuring that a single, unplanned failure of any infrastructure component will not affect IT operations. Given that the physical infrastructure risks (power, network, and the environment for storage) are significantly mitigated by the Tier 4 design, the IT manager's focus in Business Continuity Planning (BCP) must shift to areas not covered by the facility's rating. Application failures—resulting from software bugs, flawed logic, data corruption, or misconfiguration—are independent of the physical infrastructure's resilience and thus represent a more prominent remaining risk.

1. Uptime Institute. (2021). Tier Standard: Topology. TUI3026E. Section 7.0

"Tier IV: Fault Tolerant Site Infrastructure

" states

"A Tier IV data center has multiple

independent

and physically isolated systems that each have redundant capacity components... A single failure of any equipment or distribution element will not impact the IT equipment." This standard focuses on power

cooling

and network as the core infrastructure components covered.

2. National Institute of Standards and Technology (NIST). (2010). Special Publication 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems. Page 11

Section 2.3

"Types of Disruptions." The guide categorizes disruptions

listing "System/Application Failure or Malfunction" separately from facility-level issues like "Disruption of Power" or "Disruption of Telecommunications." This highlights that application failure is a distinct concern from the infrastructure failures mitigated by a Tier 4 design.

3. Patterson

D. A. (2014). CS 162: Operating Systems and Systems Programming

Lecture 21: "Data Centers." University of California

Berkeley. The lecture notes discuss data center reliability

emphasizing that while top-tier data centers (like Tier 4) solve for power and cooling failures

failures still occur due to software bugs

operator error

and network issues within the software stack

which are outside the scope of the facility's physical tier rating.

The network segment labeled LAN 4 represents a Demilitarized Zone (DMZ), which is a perimeter network located between two firewalls. A DMZ is the most secure location to deploy services for less-trusted users, such as contractors, because it isolates their traffic from the highly secured internal network (LAN 2). Placing the Wireless Access Point (WAP) in the DMZ allows contractors to access the Internet through the external firewall while the internal firewall can enforce strict rules, granting access only to specific, authorized enterprise services. This architecture upholds the principle of least privilege and protects critical assets on the internal network, such as the Database Server in LAN 2.

Stallings, W. (2017). Network Security Essentials: Applications and Standards (6th ed.). Pearson.

Reference: Chapter 9, Section 9.2, "Firewall Configurations," particularly the discussion on the "Screened Subnet Firewall System" (p. 297, Figure 9.5c). This section details the dual-firewall architecture where the DMZ is the isolated network between an external and internal firewall, which is the standard design for securely hosting systems that require external access without exposing the internal network.

Zwicky, E. D., Cooper, S., & Chapman, D. B. (2000). Building Internet Firewalls (2nd ed.). O'Reilly & Associates.

Reference: Chapter 6, "Firewall Architectures," specifically the section on "Screened Subnet" (pp. 138-142). This source describes the screened subnet (DMZ) as the canonical solution for allowing access from the Internet to selected hosts while protecting the internal network. Placing a WAP for semi-trusted users in this zone is a direct application of this principle.

Cheswick, W. R., Bellovin, S. M., & Rubin, A. D. (2003). Firewalls and Internet Security: Repelling the Wily Hacker (2nd ed.). Addison-Wesley Professional.

Reference: Chapter 4, "Firewall-Friendly Protocols and the DMZ." The chapter explains that the purpose of a DMZ is to create a "neutral zone" for machines that need to be accessible from the outside but should not be trusted on the internal network. This concept directly applies to creating a network segment for contractors.

This ranking is based on the security of how credentials are handled and the underlying cryptographic protocols.

• Basic authentication is the weakest because it sends the username and password over the network in a plaintext-equivalent form (Base64 encoding), offering no confidentiality.
• Digest authentication is an improvement, using a challenge-response protocol that avoids sending the password in the clear. However, it typically relies on the MD5 hashing algorithm, which is now considered cryptographically weak and vulnerable.
• Integrated Windows Authentication (IWA) is strong as it leverages secure, ticket-based protocols like Kerberos or the NTLMv2 challenge-response mechanism. These protocols are designed to prove a user's identity without transmitting passwords across the network.
• Client Certificate authentication is the strongest. It uses Public Key Infrastructure (PKI) for mutual authentication between the client and server. The client must possess a private key corresponding to its public certificate, providing a much higher level of identity assurance than password-based systems.

Internet Engineering Task Force (IETF). (2015). RFC 7617: The 'Basic' HTTP Authentication Scheme. Section 4: Security Considerations. This section explicitly states, "In the absence of a secure channel, the 'Basic' authentication scheme transmits credentials in the clear."

Internet Engineering Task Force (IETF). (2015). RFC 7616: HTTP Digest Access Authentication. Section 5: Security Considerations. This document discusses the advantages of Digest over Basic but notes its vulnerabilities, including the weakness of the default MD5 algorithm.

Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. In Chapter 20.3, "HTTPS," the text discusses client certificates as a strong authentication mechanism as part of TLS mutual authentication.

Microsoft Documentation. (2021). Integrated Windows Authentication. Microsoft Learn. This document details how IWA uses Kerberos and NTLM, stating, "With Integrated Windows authentication, user credentials aren't sent to the server." This inherent design makes it stronger than schemes that transmit credentials or their weak derivatives.

The activities described—allowing only necessary services (least functionality), changing default passwords, and configuring antivirus updates—are all core components of establishing and maintaining a secure system baseline. This process is known as secure Configuration Management. It involves hardening systems by defining, implementing, and enforcing a secure state to reduce the attack surface. These actions are not primarily about managing user identities, applying patches, or auditing for compliance, but rather about setting the system's configuration parameters to a known, secure standard.

1. NIST Special Publication 800-128

"Guide for Security-Focused Configuration Management of Information Systems." Section 2.1 defines Security-Focused Configuration Management (SecCM) as the management and control of configurations for an information system to enable security and manage risk. The activities listed in the question are examples of establishing a secure configuration baseline.

2. NIST Special Publication 800-53 Revision 5

"Security and Privacy Controls for Information Systems and Organizations." The Configuration Management (CM) control family directly addresses this. Specifically

control CM-7 "Least Functionality" requires the organization to configure systems to provide only essential capabilities

which includes disabling unnecessary services. Changing default passwords (IA-5) and configuring antivirus (SI-3) are also part of establishing a secure baseline configuration (CM-2).

3. Purdue University

"Information Security Policy (VII.B.2)." University policies on information security

often used in courseware

define configuration management as a key process. For example

Purdue's policy states that "System hardening and configuration management standards must be followed to protect University IT Resources from unauthorized access and misuse

" explicitly linking hardening activities to configuration management. (See Section on System Administration Practices).

The matching is based on the defining characteristics of each access control model.

• Mandatory Access Control (MAC) is a non-discretionary model where a central authority defines access policies based on security labels (e.g., clearance levels). The end user has no authority to change these system-enforced rules.
• Discretionary Access Control (DAC) allows the owner (subject) of a resource (object) to determine the access permissions for other users at their discretion.
• Role Based Access Control (RBAC) simplifies administration by grouping permissions into roles that correspond to job functions. Users are assigned roles, thereby acquiring the permissions associated with those duties.
• Rule Based Access Control uses specific rules or policies that evaluate conditions (criteria) to grant or deny access. A sophisticated implementation of this model can dynamically assign roles to a subject if certain criteria, set by an administrator (custodian), are met.

For MAC and DAC: Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM, 17(7), 38-41. (In Section I.A.3, "Design Principles," the document contrasts centrally-managed, mandatory controls with schemes where individual users control access to their own data, which is the core of the MAC vs. DAC distinction). DOI: https://doi.org/10.1145/361011.361062

For RBAC: Ferraiolo, D. F., & Kuhn, D. R. (1992). Role-Based Access Control. Proceedings of the 15th National Computer Security Conference, (pp. 554-563). (This foundational paper defines RBAC as a method of restricting system access to authorized users based on their roles within an organization. Section 3, "The Model," explicitly links roles to job functions). Available via NIST: https://csrc.nist.gov/csrc/media/projects/role-based-access-control/documents/ferraiolo-kuhn-92.pdf

For Rule-Based/Attribute-Based Control: Hu, V. C., Ferraiolo, D., Kuhn, R., Schnitzer, A., Sandlin, K., Miller, R., & Scarfone, K. (2014). Guide to Attribute Based Access Control (ABAC) Definition and Considerations (NIST Special Publication 800-162). National Institute of Standards and Technology. (Section 2.1 defines ABAC, a modern form of rule-based control, as a model where rules evaluate attributes—or criteria—to make access decisions. This can include dynamically managing a subject's privileges or role memberships based on these attributes). DOI: https://doi.org/10.6028/NIST.SP.800-162

The question explicitly sets aside the issue of confidentiality ("aside from the potential records which may have been viewed"). In the context of a financial database, the next most critical concern is data integrity. An unauthorized individual with access could modify, insert, or delete financial records, leading to fraudulent transactions, incorrect financial reporting, and significant legal and reputational damage. The trustworthiness and accuracy of financial data are paramount to business operations. Therefore, verifying that no unauthorized changes were made is the primary concern after establishing that a breach occurred.

1. Stewart

J. M.

Chapple

M.

& Gibson

D. (2021). CISSP (ISC)2 Certified Information Systems Security Professional Official Study Guide (9th ed.). Wiley. In Domain 2

"Asset Security

" the text emphasizes that data integrity is a critical security objective

ensuring that data is accurate and reliable. For financial systems

this is often considered as important as confidentiality (pp. 120-121).

2. Harris

S.

& Maymi

F. (2021). CISSP All-in-One Exam Guide (9th ed.). McGraw-Hill. Chapter 3

"Security Engineering

" discusses the CIA triad. It explains that integrity controls are designed to prevent unauthorized modification of data. In a financial context

an undetected modification could be more damaging than a disclosure (p. 105).

3. Von Solms

R.

& Van Niekerk

J. (2013). From information security to cyber security. Computers & Security

38

97-102. https://doi.org/10.1016/j.cose.2013.04.004. This academic paper discusses the evolution of security concerns

reinforcing that for many systems

particularly financial ones

the integrity of information (ensuring it is unaltered) is a fundamental and primary security requirement alongside confidentiality.

The methods are ranked based on their effectiveness in rendering data irrecoverable.

1. Destruction is the most effective method as it physically destroys the media (e.g., through shredding, pulverizing, or incineration), making data recovery impossible.
2. Degaussing is the next best, using a powerful magnetic field to neutralize the magnetic alignment on the media, effectively erasing the data and making it infeasible to recover even with advanced laboratory techniques.
3. Overwriting involves writing new patterns of data over the original data. While effective against simple recovery tools, sophisticated forensic methods might still be able to recover data remnants.
4. Deleting is the least effective method. It typically only removes the file's pointer from the file system's index, leaving the actual data on the disk until it is overwritten by new files. This data is easily recovered with common software.

NIST Special Publication 800-88 Rev. 1, Guidelines for Media Sanitization. This standard defines the hierarchy of sanitization methods.

Section 2.4, "Destruction": Describes methods like disintegration, pulverization, melting, and incineration as the ultimate form of sanitization. "Destruction of media is the most secure method of sanitization." (Page 8).

Section 2.3, "Purge": Defines Purge techniques, including Degaussing, as rendering data recovery "infeasible using state of the art laboratory techniques." (Page 8).

Section 2.2, "Clear": Defines Clear techniques, including Overwriting, as applying "logical techniques to sanitize data in all user-addressable storage locations for protection against simple non-invasive data recovery techniques." (Page 7). Standard file deletion is explicitly noted as not being a sufficient method of clearing.

Garfinkel, S., & Rosen, R. (2015). A Guide to Understanding Data Remanence in Automated Information Systems. National Institute of Standards and Technology.

Section 3.1, "Data Deletion versus Media Sanitization": "Deleting a file on a typical file system is a simple, fast operation. In most cases, the operation simply removes the directory entry for the file and returns the file’s allocated blocks to the pool of free space... the file’s data blocks are not actually modified in any way and could be recovered." (Page 9). This confirms 'Deleting' as the least secure option.

Zhi, L. (2010). A new approach to information security of computer hard disk. 2010 2nd IEEE International Conference on Information Management and Engineering. https://doi.org/10.1109/ICIME.2010.5477465

Section III, "Common Methods of Hard Disk Information Security": This paper reviews common methods and implicitly ranks their security. It describes physical destruction as providing "the highest security degree," degaussing as a "reliable secure erasure method," and overwriting as a method that can be defeated by specialized equipment, placing them in the same hierarchy as the NIST standard.

The most significant privacy concern when outsourcing to a Cloud Service Provider (CSP) is the potential for data to be stored in a different legal jurisdiction. When data crosses national borders, it becomes subject to the laws of the country where the CSP's data centers are located. These laws may offer weaker privacy protections or grant government agencies broader access to data than the laws in the organization's home country. This issue, often termed data sovereignty or jurisdictional risk, can place the organization in direct conflict with its own legal and compliance obligations (e.g., GDPR, HIPAA), creating a fundamental risk to data privacy.

1. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-144

Guidelines on Security and Privacy in Public Cloud Computing.

Section 5.2.2.3

Jurisdictional: "Data stored in the cloud can be located in a jurisdiction that has a different legal framework from that of the cloud consumer... This can lead to situations where the legal protections and obligations that apply to the data are different from what the cloud consumer expects or requires." This directly supports the choice of jurisdictional risk as a primary concern.

2. European Union Agency for Cybersecurity (ENISA)

Cloud Computing Risk Assessment.

Section 4.1

Policy and Organisational Risks

Risk O3: Compliance challenges: The document states

"Compliance with legal requirements may be difficult to achieve or prove when using cloud services... For example

customer data may be held in a jurisdiction with weaker data protection rules." This highlights the legal and compliance risks tied to the CSP's location.

3. Cloud Security Alliance (CSA)

Security Guidance for Critical Areas of Focus in Cloud Computing v4.0.

Domain 2: Governance and Enterprise Risk Management

Section on "Governing in the Cloud": This section discusses the importance of understanding the legal and regulatory implications of where data is stored and processed

stating

"The physical location of the data and the legal jurisdiction it falls under can have significant impacts on an organization's risk and legal responsibilities."

Link encryption operates at the Physical or Data Link layers (Layers 1 or 2) of the OSI model. It encrypts the entire data packet, including the payload, header, and routing information, before transmitting it across a physical link to the next node. At the next node (e.g., a router), the packet is decrypted, the routing information is read, and then the entire packet is re-encrypted before being sent to the subsequent node. This process provides traffic-flow security because an attacker monitoring the link cannot see the source and destination addresses in the packet header, only encrypted data.

1. Stallings

W. (2020). Cryptography and Network Security: Principles and Practice (8th ed.). Pearson. In Chapter 16.2

"Location of Encryption Devices

" it is stated

"With link encryption

all the traffic over a communications link is encrypted... Because the packet headers are encrypted

traffic-flow information is secure."

2. National Institute of Standards and Technology (NIST). (1995). An Introduction to Computer Security: The NIST Handbook (Special Publication 800-12). In Section 15.4.1

"Link Encryption

" the document explains

"Link encryption encrypts all the data along a communications path... This process hides the routing information from an eavesdropper." (p. 128).

3. Whitman

M. E.

& Mattord

H. J. (2019). Principles of Information Security (6th ed.). Cengage Learning. This university textbook notes in Chapter 8

"Telecommunications and Network Security

" that link encryption "encrypts and decrypts all traffic at each point-to-point

for example

from router to router... the entire packet

including the header and payload

is encrypted." (p. 343).

The information classification process follows a logical lifecycle. It begins with creating an inventory of all information assets to understand what needs protection. Next, each asset is assigned a classification level (e.g., Public, Confidential) based on its sensitivity and value. Once classified, assets must be labeled with appropriate security markings so that users can understand the handling requirements. The classification is not static; therefore, periodic reviews are essential to ensure the assigned levels remain accurate as the information's value changes over time. Finally, when the information is no longer sensitive or required to be protected at a specific level, it is formally declassified, completing its lifecycle.

ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Annex A, Control A.5.12 (Classification of information): This control states that "Information shall be classified in terms of legal requirements, value, criticality and sensitivity to unauthorized disclosure or modification." This precedes labeling.

Annex A, Control A.5.13 (Labelling of information): This control specifies that "An appropriate set of procedures for information labelling shall be developed and implemented in accordance with the information classification scheme..." This step logically follows the assignment of a classification level.

National Institute of Standards and Technology (NIST) Special Publication 800-60 Vol. 1 Rev. 1, Guide for Mapping Types of Information and Information Systems to Security Categories

Section 2.3 (The Categorization Process): This section outlines a process that begins with identifying and documenting information types, which corresponds to "Document the information assets." The subsequent steps involve mapping these types to security categories, which is analogous to "Assign a classification level."

Al-Hamami, A., & Al-Ghadhban, M. (2014). Data Classification in Information Security and Privacy. Proceedings of the World Congress on Engineering 2014 Vol II, WCE 2014, July 2 - 4, 2014, London, U.K.

Section III (DATA CLASSIFICATION): The paper describes the data classification lifecycle, stating, "The process of data classification starts with data identification... After data are identified and documented, a classification level must be assigned..." This supports the sequence of documenting assets before assigning a classification level. The paper also discusses the importance of ongoing review and eventual declassification. DOI: Not available, but published in IAENG proceedings.

This matching exercise pairs fundamental black-box testing techniques with their specific methods for selecting test inputs, particularly for negative or error-handling test cases.

• State-Based Analysis focuses on testing the system's behavior as it moves between different states. A key aspect is to provide an unexpected or invalid input for a specific state (a known condition) to ensure it is handled gracefully without causing a system failure.
• Equivalence Class Analysis divides all possible inputs into partitions or "classes." The most robust test plans select representatives from each valid and invalid partition. Selecting an input that falls outside any defined partition tests the system's default error-handling capabilities.
• Decision Table Analysis is ideal for testing complex business rules governed by multiple conditions. It maps combinations of inputs to specific actions. Testing invalid or impossible combinations is crucial to verify that the system's logic correctly identifies and rejects them.
• Boundary Value Analysis is a technique based on the principle that errors often occur at the edges or boundaries of input domains. Therefore, test cases are designed specifically using values at the minimum and maximum limits of a valid range.

Ammann, P., & Offutt, J. (2016). Introduction to Software Testing (2nd ed.). Cambridge University Press.

Boundary Value Analysis: "Boundary value analysis (BVA) is based on a simple observation: programmers often make mistakes on the boundaries of input and output domains." (Chapter 4, Section 4.2, p. 77). This directly supports matching BVA with selecting inputs at the external limits.

Equivalence Class Partitioning: This source describes creating partitions for both valid and invalid inputs. The concept of selecting an input outside all partitions is an extension of testing invalid classes to check default error conditions. (Chapter 4, Section 4.1, pp. 74-75).

Jorgensen, P. C. (2013). Software Testing: A Craftsman's Approach (4th ed.). CRC Press.

Decision Table Testing: "The real value of decision tables for testing is that they deal with combinations of inputs." The text further explains creating test cases for each column (rule), which inherently includes testing invalid or contradictory combinations to ensure proper error handling. (Chapter 8, Section 8.2, pp. 201-205).

State-Based Testing: "We can ask what happens if an invalid event occurs in a state... This is a standard test for robustness." This confirms that testing with unexpected inputs (invalid events) for a given state is a core part of State-Based Analysis. (Chapter 9, Section 9.4, p. 235).

Koomen, T., van der Aalst, L., Broekman, B., & Vroon, M. (2006). TMap NEXT: For result-driven testing. Addison-Wesley Professional.

This industry-standard text outlines these techniques in practice. It describes State-Transition Testing (State-Based Analysis) as involving the creation of test cases for invalid transitions (p. 288), Decision Table Testing for combinations of conditions (p. 286), and Boundary Value Analysis for the "outermost values of equivalence classes" (p. 284).

User awareness training is most effective at modifying unintentional user behaviors that introduce risk. User-instigated events, such as falling for phishing scams or social engineering, are the primary target of such training, making it the most impacted category. Many virus infiltrations rely on user actions like clicking malicious links or opening infected attachments, so training is also highly effective here, though some malware can propagate without user interaction. Targeted infiltration (e.g., Advanced Persistent Threats) often employs sophisticated, customized social engineering that is harder for a typical user to detect, making training less effective than against generic threats. Finally, training has the least impact on disloyal employees, as their actions are driven by malicious intent, not ignorance. Deterring intentional, malicious acts requires different controls, such as monitoring and access management, rather than awareness education.

User-instigated & Virus Infiltrations: According to NIST Special Publication 800-50, "Building an Information Technology Security Awareness and Training Program," the primary goal is to change user behavior to mitigate threats. Section 2.2 states that awareness activities "help users to understand and respond to threats such as... malicious logic (e.g., viruses, worms, Trojan horses), and social engineering." This directly addresses the reduction of user-instigated events and many common virus infiltration vectors.

Targeted Infiltration: In a study on defending against advanced threats, researchers note, "While security training helps, it cannot be considered a panacea for social engineering... Attackers are skilled at crafting context-aware, compelling communications that can deceive even wary users." This highlights that while training is beneficial, its efficacy is reduced against the highly sophisticated social engineering tactics used in targeted infiltrations. (Source: Al-Shaer, E., & Wei, J. (2014). Cyber-Physical Systems Security. IEEE Press, Chapter 5, pp. 115-117).

Disloyal Employees (Insider Threat): Research on insider threats consistently shows that malicious insiders act with intent, which training does not address. A key paper on the topic states, "Unintentional insiders... may be addressed with improved awareness and training programs. Malicious insiders, however, require a different set of countermeasures..." such as behavioral analysis and stricter access controls. (Source: Kandias, M., Mylonas, A., & Gritzalis, D. (2012). "A Social-Based Analysis of the Insider Threat," Proceedings of the 7th International Conference on Security and Cryptography, SECRYPT 2012, pp. 207-212. DOI: 10.5220/0004071502070212).

This sequence represents a logical and standard methodology for establishing an effective vulnerability management program.

1. Identify assets: The foundational step is to create a comprehensive inventory of all hardware and software assets. An organization cannot protect what it does not know it has. This step defines the scope of the entire program.
2. Identify risks: Once assets are known, an initial risk assessment is performed to identify existing vulnerabilities and understand their potential impact. This establishes a baseline and helps prioritize subsequent actions.
3. Implement recurring scanning schedule: To ensure continuous discovery, an automated scanning process is implemented. This operationalizes the vulnerability identification phase, allowing the organization to detect new vulnerabilities in a timely manner.
4. Implement change management: Before remediation actions (like patching) are performed, a formal governance process for change management must be established. This ensures that all changes are reviewed, tested, and approved, minimizing operational disruption.
5. Implement patch deployment: With a governance framework in place, the technical tools and procedures for patch deployment can be implemented. This is the primary remediation step to fix the vulnerabilities discovered during scanning.

The MITRE Corporation. (2010). A Reference Architecture for Enterprise Vulnerability Management. Section 2.1, "Foundational Components," emphasizes that Asset Management is a prerequisite for the vulnerability management lifecycle, which consists of scanning, analysis, and remediation.

National Institute of Standards and Technology (NIST). (2020). Special Publication (SP) 800-53, Revision 5: Security and Privacy Controls for Information Systems and Organizations. Control RA-5 (Vulnerability Monitoring and Scanning) mandates scanning systems, which presupposes an inventory defined in CM-8 (System Component Inventory). Furthermore, remediation is governed by CM-3 (Configuration Change Control), reinforcing the need for change management before implementing fixes.

Enck, W., & Moyer, T. (2007). Towards a More Secure, Available, and Manageable Enterprise Infrastructure. MIT Lincoln Laboratory. The paper discusses the importance of a structured approach starting with asset discovery, followed by vulnerability assessment, and then controlled remediation, highlighting that "patch management is the primary mechanism for mitigating software vulnerabilities" (p. 2) and must be done in a controlled manner.

Al-Shaer, E., & El-Atawy, A. (2008). Network configuration in a box: A toolbox for building secure and available network configuration management systems. Proceedings of the 4th International Workshop on Security and Trust Management (STM '08). The work implicitly supports the sequence by discussing the necessity of knowing the network state (assets and configuration) before managing changes and vulnerabilities. DOI: 10.1007/978-3-540-85247-0_1

Power analysis is a type of non-invasive side-channel attack that is uniquely effective against cryptographic hardware modules. It involves monitoring the fluctuating electrical power consumption of a device as it performs cryptographic computations. These power variations can be statistically analyzed to reveal correlations with the secret keys being processed, allowing an attacker to extract sensitive information without breaking the underlying cryptographic algorithm. This attack targets the physical implementation of the hardware, bypassing many of the logical protections that make such modules secure against other forms of attack.

1. Kocher

P.

Jaffe

J.

& Jun

B. (1999). Differential Power Analysis. In M. Wiener (Ed.)

Advances in Cryptology — CRYPTO’ 99 (Vol. 1666

pp. 388–397). Springer. The abstract and introduction (Section 1) establish that power consumption analysis can be used to extract secret keys from tamper-resistant devices like smart cards. DOI: https://doi.org/10.1007/3-540-48405-125

2. National Institute of Standards and Technology (NIST). (2019). FIPS PUB 140-3: Security Requirements for Cryptographic Modules. Section 7.8

"Non-Invasive Security

" explicitly lists power analysis as a relevant attack vector that cryptographic modules must be designed to protect against at higher security levels.

3. Boneh

D. (n.d.). CS255: Introduction to Cryptography

Lecture 18: Side Channel Attacks. Stanford University Courseware. The lecture notes detail various side-channel attacks

highlighting power analysis as a primary method for attacking physical cryptographic implementations. Available at: https://crypto.stanford.edu/~dabo/courses/CS255/lectures/18-side-channels.pdf

A significant security weakness in the Common Criteria (CC) evaluation process is that the product manufacturer (the sponsor) defines the scope of the evaluation. The sponsor specifies the exact version, features, and configuration of the product to be tested, known as the Target of Evaluation (TOE), in a document called the Security Target (ST). This allows the sponsor to present a "best-case," highly secured, and potentially unrealistic configuration for assessment. The resulting certification is only valid for that specific configuration, which may not reflect how the product is deployed or used in a real-world operational environment, creating a potential gap between certified security and actual security.

1. Bishop

M. (2004). The Common Criteria: A Mixed Blessing. In Proceedings of the 2004 workshop on New security paradigms (NSPW '04). Association for Computing Machinery

New York

NY

USA

11–17. (DOI: https://doi.org/10.1145/1146260.1146263). On page 12

Bishop notes

"The vendor writes the ST [Security Target]

and so can tailor it to the product’s strengths and omit its weaknesses... This allows the vendor to choose the grounds on which its TOE will be evaluated."

2. Common Criteria for Information Technology Security Evaluation. (2017

April). Part 1: Introduction and general model

Version 3.1

Revision 5. CCMB-2017-04-001. Section 5.3.2

"Security Target

" states

"The ST is a statement of the security claims for a specific TOE... The ST is provided by the author of the ST (e.g. the developer)." This confirms the vendor's role in defining the evaluation scope.

3. Grünwald

G.

& Scheuermann

D. (2008). On the Practicality of the Common Criteria. In Trust and Trustworthy Computing. Springer

Berlin

Heidelberg. (DOI: https://doi.org/10.1007/978-3-540-68979-913). The paper discusses that vendors can "choose the EAL and the security functionality to be evaluated

" which can lead to a minimal set of functions being tested to achieve certification

not necessarily reflecting the full product.

4. Pfleeger

C. P.

& Pfleeger

S. L. (2003). Security in Computing

3rd Edition. Prentice Hall. In Chapter 8

"Program Security

" the text discusses evaluation criteria and notes the limitation that evaluations apply only to the specific configuration tested

which may differ from how a product is used in practice.