Vulnerabilities in Systems MindMap (4 of 9) | CISSP Domain 3

Review of the major Vulnerabilities in Systems topics to guide your studies, and help you pass the CISSP exam.

This MindMap review covers:
00:00 Introduction
00:35 Vulnerabilities in Systems
01:07 Single Point of Failure
01:33 Redundancy
01:48 Bypass Controls
02:21 Mitigating Controls
02:57 TOCTOU (Race Conditions)
03:28 Increase frequency of Re-authentication
03:53 Emanations
04:13 Shielding (TEMPEST)
04:34 White Noise
04:48 Control Zones
05:04 Covert Channels
05:20 Analysis & Design
05:36 Aggregation & Inference
05:55 Polyinstantiation
06:21 Mobile Devices
06:42 Policy, training & procedures
07:03 Remote access security
07:16 Endpoint Security
07:28 OWASP Mobile Top 10
07:43 M1: Improper Platform Usage
07:58 M2: Insecure Data Storage
08:24 M3: Insecure Communication
08:43 M4: Insecure Authentication
09:03 M5: Insufficient Cryptography
09:17 M6: Insecure Authorization
09:48 M7: Client Code Quality
10:10 M8: Code Tampering
10:26 M9: Reverse Engineering
10:47 M10: Extraneous Functionality
11:11 Web-based Vulnerabilities
11:26 Cross Site Scripting (XSS)
11:49 Stored (Persistent)
12:45 Reflected (Most common)
13:31 DOM
13:41 Target of Attack: Client
13:53 Cross Site Request Forgery (CSRF)
14:18 Target of Attack: Server
14:28 SQL Injection
15:32 Input Validation
16:08 Client Side vs. Server Side
16:36 Allow Lists vs. Deny Lists
17:36 Outro

Join our r/DestCert subreddit for valuable CISSP resources, training advice, support, and to connect with other CISSP professionals!

[destcert]

Hey everyone! Just a quick note about the video at 14:20. There's a small error where I say "server" but it should have been "SQL injection." Don't worry, the fix is already underway! Thanks for watching!

--

We make it as easy as possible for you to efficiently achieve your CISSP certification.

You can learn all about our CISSP MasterClass and enrol here: destcert.com/cissp.

[ahmedabuelatta]

some pizza stores close to the Pentagon, said there is a higher demand for pizza before an invasion. that happened in the Panama War and later in the first Gulf War. Another covert Channel example, is, that it was commonly when there was immediate action, the US Eisenhower carriers gave more expensive seafood to the crew, like jumbo shrimp, that's how Analysis knew they would leave the eastern of the Mediterranean Sea

[H._sapiens]

There is an error in the voice over for this new version of this video. It says the target of CSRF is "SQL Injection", when it should be "the Server" at around 14:20. The old version doesn't have this video editing mistake.

[bherrera]

Going to test next month, wish me luck : ) these videos pair well with practice tests

[saltfork]

Nobody got the predictive power of pizza deliveries reference?

[classiquai]

aggregation vs inference are two different concepts. it's not "aggregation" of data resulting "inference"

[ihatetechnology.....]

I was really hoping the predictive power of pizza deliveries was going to be a Snow Crash reference

[monishkhan]

Sounds like the XSS attacker is a certified baddie 😂
(These videos are really helpful tho)

[moawiamohammed]

Very informative, didn't get the pizza reference though :(

[ITCertAcademy]

Pizza: The fact that the number of pizza deliveries can be used to predict certain events or behaviors is a prime example of a covert channel. A covert channel is a communication method that is not intended for information transfer at all, yet it can reveal or transmit hidden data. In this case, by analyzing patterns in pizza deliveries, one could potentially infer or predict unrelated and non-obvious information, such as the occurrence of specific events or changes in human activity.

[aabeard]

White lists and Black lists are established terminology, I'm anit changing common terminology to suite the most sensitive among us. That being said, you can't help being Canadian, I forgive your ultra-polite self.

[Hopkins]

What’s up with the skipping words. Bad audio editing.