Securing virtual environments for VMware, Citrix, and Microsoft hypervisors
Virtualization changes the playing field when it comes to security. There are new attack vectors, new operational patterns and complexity, and changes in IT architecture and deployment life cycles. What’s more, the technologies, best practices, and strategies used for securing physical environments do not provide sufficient protection for virtual environments. This book includes step-by-step configurations for the security controls that come with the three leading hypervisor–VMware vSphere and ESXi, Microsoft Hyper-V on Windows Server 2008, and Citrix XenServer.
Includes strategy for securely implementing network policies and integrating virtual networks into the existing physical infrastructure
Discusses vSphere and Hyper-V native virtual switches as well as the Cisco Nexus 1000v and Open vSwitch switches
Offers effective practices for securing virtual machines without creating additional operational overhead for administrators
Contains methods for integrating virtualization into existing workflows and creating new policies and processes for change and configuration management so that virtualization can help make these critical operations processes more effective
This must-have resource offers tips and tricks for improving disaster recovery and business continuity, security-specific scripts, and examples of how Virtual Desktop Infrastructure benefits security.
Dave Shackleford is founder and Principal Consultant with Voodoo Security, Senior Vice President of Research and CTO at IANS, and a SANS senior instructor and course author. He has consulted with hundreds of organizations in the areas of security, regulatory compliance, and network architecture and engineering. He is a VMware vExpert and has extensive experience designing and configuring secure virtualized infrastructures. Recently, Dave coauthored the first published course on virtualization security for the SANS Institute. He currently serves on the board of directors at the SANS Technology Institute and helps lead the Atlanta chapter of the Cloud Security Alliance.
The Official (ISC)² Guide to the CISSP-ISSEP CBK provides an inclusive analysis of all of the topics covered on the newly created CISSP Concentration. The first fully comprehensive guide to the CISSP-ISSEP CBK, this book promotes understanding of the four ISSEP domains: Information Systems Security Engineering (ISSE); Certification and Accreditation; Technical Management; and an Introduction to United States Government Information Assurance Regulations.
The (ISC)²® Systems Security Certified Practitioner (SSCP®) certification is one of the most important credentials an information security practitioner can have. Having helped thousands of people around the world obtain this distinguished certification, the bestselling Official (ISC)2 Guide to the SSCP CBK® has quickly become the book that many of today’s security practitioners depend on to attain and maintain the required competence in the seven domains of the (ISC)²CBK.
Picking up where the popular first edition left off, the Official (ISC)2 Guide to the SSCP CBK, Second Edition brings together leading IT security tacticians from around the world to discuss the critical role that policy, procedures, standards, and guidelines play within the overall information security management infrastructure. Offering step-by-step guidance through the seven domains of the SSCP CBK, the text:
Presents widely recognized best practices and techniques used by the world’s most experienced administrators
Uses accessible language, bulleted lists, tables, charts, and diagrams to facilitate a clear understanding
Prepares you to join the thousands of practitioners worldwide who have obtained (ISC)² certification
Through clear descriptions accompanied by easy-to-follow instructions and self-assessment questions, this book will help you establish the product-independent understanding of information security fundamentals required to attain SSCP certification. Following certification it will be a valuable guide to addressing real-world security implementation challenges.
467 pp, hardcover. Please note that this book cannot be returned except for exchange if defective.
As the global leader in information security education and certification, (ISC)2® has a proven track record of educating and certifying information security professionals. Its newest certification, the Certified Secure Software Lifecycle Professional (CSSLP®) is a testament to the organization’s ongoing commitment to information and software security.
The Official (ISC)2® Guide to the CSSLP®provides an all-inclusive analysis of the CSSLP Common Body of Knowledge (CBK®). As the first comprehensive guide to the CSSLP CBK, it facilitates the required understanding of the seven CSSLP domains—Secure Software Concepts, Secure Software Requirements, Secure Software Design, Secure Software Implementation/Coding, Secure Software Testing, Software Acceptance, and Software Deployment, Operations, Maintenance and Disposal—to assist candidates for certification and beyond.
This book serves as the only official guide to the CSSLP professional certification, details the software security activities that need to be incorporated throughout the software development lifecycle, provides comprehensive coverage that includes the people, processes, and technology components of software, networks, and host defenses, and supplies a pragmatic approach to implementing software assurances in the real-world.
The text allows readers to learn about software security from a renowned security practitioner who is the appointed software assurance advisor for (ISC)2. Complete with numerous illustrations, it makes complex security concepts easy to understand and implement. In addition to being a valuable resource for those studying for the CSSLP examination, this book is also an indispensable software security reference for those already part of the certified elite. A robust and comprehensive appendix makes this book a time-saving resource for anyone involved in secure software development.
572 pages, hardcover. Please note that this book cannot be returned except for exchange if defective.
Manoranjan (Mano) Paul is the Software Assurance Advisor for the (ISC)2, the global leader in information security education and certification, representing and advising the organization on software assurance strategy, training, education and certification. His information security and software assurance experience includes designing and developing security programs from compliance-to-coding, security in the SDLC, writing secure code, risk management, security strategy, and security awareness training and education.
Mr. Paul started his career as a shark researcher in the Bimini Biological Field Station, Bahamas. His educational pursuit took him to the University of Oklahoma where he received his Business Administration degree in Management Information Systems (MIS) with various accolades and the coveted 4.0 GPA. Following his entrepreneurial acumen, he founded and serves as the CEO & President of Express Certifications, a professional certification assessment and training company that developed studISCope, (ISC)2’s official self assessment offering for prospective certification candidates. Express Certifications is also the self assessment testing company behind the US Department of Defense certification education program as mandated by the 8570.1 directive. He also founded SecuRisk Solutions, a company that specializes in security product development and consulting.
Before Express Certifications and SecuRisk Solutions, Mr. Paul played several roles from software developer, quality assurance engineer, logistics manager, technical architect, IT strategist, and security engineer/program manager/strategist at Dell Inc. Mr. Paul is an appointed faculty member and Vice President of the Capitol of Texas Information System Security Association (ISSA) chapter. He is a contributing author for the Information Security Management Handbook, writes periodically for the Certification magazine and has contributed to security topics for the Microsoft Solutions Developer Network (MSDN). He has been featured in various domestic and international security conferences and is an invited speaker and panelist, delivering talks and keynotes in conferences such as the CSI (Computer Security Institute), Burton Group Catalyst, SC World Congress, TRISC (Texas Regional Infrastructure Security Conference) and OWASP. Mr. Paul holds the following professional certifications – CSSLP, CISSP, AMBCI, MCSD, MCAD, CompTIA Network+ and the ECSA certification.
The Official (ISC)2® Guide to the ISSAP® CBK assures competence of the six major domains of the Information Systems Security Architecture Professional (ISSAP) Concentration. This concentration is fundamentally the consultative and analytical process of information security. Using this guide ISSAP candidates will understand the key concepts and requirements within the ISSAP CBK. They gain knowledge of access control systems and methodologies, telecommunications and network security, cryptography, requirements analysis, business continuity and disaster recovery planning, and physical security integration. Hal Tipton, editor. 500 pages.
