2 cissp ® Official Study Guide Eighth Edition

Understand common characteristics of security controls.
Security controls should be 
transparent to users. Hash totals and CRC checks can be used to verify message integrity. 
Record sequences are used to ensure sequence integrity of a transmission. Transmission
logging helps detect communication abuses.
Understand how email security works.
Internet email is based on SMTP, POP3, and 
IMAP. It is inherently insecure. It can be secured, but the methods used must be addressed 
in a security policy. Email security solutions include using S/MIME, MOSS, PEM, or PGP.
Know how fax security works.
Fax security is primarily based on using encrypted trans-
missions or encrypted communication lines to protect the faxed materials. The primary 
goal is to prevent interception. Activity logs and exception reports can be used to detect 
anomalies in fax activity that could be symptoms of attack.

---

Written Lab 
573
Know the threats associated with PBX systems and the countermeasures to PBX fraud.
Countermeasures to PBX fraud and abuse include many of the same precautions you would 
employ to protect a typical computer network: logical or technical controls, administrative 
controls, and physical controls.
Understand the security issues related to VoIP.
VoIP is at risk for caller ID spoofing,
vishing, SPIT, call manager software/firmware attacks, phone hardware attacks, DoS, 
MitM, spoofing, and switch hopping.
Recognize what a phreaker is.
Phreaking is a specific type of attack in which various 
types of technology are used to circumvent the telephone system to make free long-dis-
tance calls, to alter the function of telephone service, to steal specialized services, or even 
to cause service disruptions. Common tools of phreakers include black, red, blue, and 
white boxes.