SSCP Study Notes
1. Access Controls
2. Administration
3. Audit and Monitoring
4. Risk, Response, and Recovery
5. Cryptography
6. Data Communications
7. Malicious Code

Modified version of original study guide by Vijayanand Banahatti (SSCP)

Table of Content

1.0 ACCESS CONTROLS…………………………………………………………...... 03
2.0 ADMINISTRATION ……………………………………………………………... 07
3.0 AUDIT AND MONITORING…………………………………………………...... 13
4.0 RISK, RESPONSE, AND RECOVERY………………………………………....... 18
5.0 CRYPTOGRAPHY……………………………………………………………....... 21
6.0 DATA COMMUNICATIONS…………………………………………………...... 25
7.0 MALICIOUS CODE……………………………………………………………..... 31
REFERENCES………………………………………………………………………........ 33 1.0 ACCESS CONTROLS

Access control objects: Any objects that need controlled access can be considered an access control object. Access control subjects: Any users, programs, and processes that request permission to objects are access control subjects. It is these access control subjects that must be identified, authenticated and authorized. Access control systems: Interface between access control objects and access control subjects.

1.1 Identification, Authentication, Authorization, Accounting

1.1.1 Identification and Authentication Techniques
Identification works with authentication, and is defined as a process through which the identity of an object is ascertained. Identification takes place by using some form of authentication.

Authentication Types Example
Something you know Passwords, personal identification numbers (PIN), pass phrases, mother's maiden name, fave sports team etc
Something you have Proximity cards, Identification tokens, Keys,
Identification badges, Passports, certificates, transponders, smart cards etc.
Something you are Fingerprints, Signatures, Eye characteristics, Facial characteristics, Voiceprints, DNA.
These three types of