CISSP Domain 4: Communication and Network Security
Đây là 1 trong 8 domain của kỳ thi CISSP (Certified Information Systems Security Professional) – chứng chỉ vàng cho quản trị an ninh thông tin. Domain 4 chiếm ~13% câu hỏi, bao gồm:
4.1 Secure Network Architecture Design (Thiết kế kiến trúc mạng an toàn)
- Defense in Depth (DiD): Lớp lớp kiểm soát: Perimeter → Network → Endpoint → Application → Data.
- Segmentation / Zero Trust: VLAN, VRF, Micro-segmentation (Cisco ACI, VMware NSX, Illumio), Software-Defined Perimeter (SDP).
- Network Topologies: DMZ, Screened Subnet, Three-homed Firewall, Hub-and-Spoke, Full Mesh, SD-WAN, SASE.
- Converged Protocols: VoIP (SIP/SRTP), FCoE, iSCSI, RoCE, NVMe-oF – bảo mật storage/network convergence.
- Wireless Security: WPA3-Enterprise (EAP-TLS), 802.1X, NAC, WIPS/WIDS, RF monitoring.
- Remote Access: IPsec VPN (IKEv2, ESP/AH), SSL/TLS VPN, WireGuard, ZTNA (Zero Trust Network Access), Clientless VPN.
4.2 Secure Network Components (Thành phần mạng an toàn)
- Firewall (NGFW): Stateful, App-ID, User-ID, SSL Decrypt, IPS, AV, File Sandbox, DNS Security.
- Router/Switch Security: Control Plane Policing (CoPP), Routing Protocol Auth (BGP MD5/SHA, OSPF/IPv6 Auth), uRPF, BGPsec, DHCP Snooping, DAI, IP Source Guard, Port Security, Storm Control.
- Load Balancer / ADC: SSL Offload, WAF, DDoS Protection, Global Server Load Balancing (GSLB).
- Proxy / Secure Web Gateway: Forward/Reverse Proxy, SSL Inspection, DLP, CASB, RBI (Remote Browser Isolation).
- IDS/IPS (Network & Host): Signature (Snort/Suricata), Anomaly/Behavioral (Zeek, Corelight), Network Traffic Analysis (NTA/NDR).
- DNS Security: DNSSEC, DoH/DoT, RPZ, Protective DNS (Quad9, Cisco Umbrella, Cloudflare Gateway).
4.3 Secure Communication Channels (Kênh truyền thông an toàn)
- VPN Protocols: IPsec (IKEv1/IKEv2, ESP Tunnel/Transport, AES-GCM, PFS Group 14/19/20/21), SSL/TLS VPN, WireGuard (Noise Protocol), L2TP/IPsec (deprecated).
- TLS/SSL: TLS 1.2/1.3 only, Cipher Suite mạnh (ECDHE, AES-GCM, CHACHA20-POLY1305), Certificate Pinning, HSTS, OCSP Stapling, CT Logs.
- Email Security: S/MIME, PGP/GPG, DKIM, SPF, DMARC, MTA-STS, TLS-RPT.
- Voice/Video: SRTP, ZRTP, DTLS-SRTP, SIPS.
- IoT/OT Protocols: MQTT over TLS, CoAP/DTLS, OPC UA Security, Modbus/TCP Secure, PROFINET Security.
4.4 Network Attacks & Countermeasures (Tấn công mạng & Phòng thủ)
| Tấn công | Mô tả | Phòng thủ (Countermeasures) |
|---|---|---|
| DoS/DDoS (Volumetric, Protocol, App Layer) | Ngập tài nguyên băng thông/CPU/State table | Scrubbing Center, Anycast, Rate-limiting, SYN Cookie, Challenge-Response, WAF, Bot Management |
| Man-in-the-Middle (MitM) | ARP Spoofing, DHCP Spoofing, DNS Spoofing, BGP Hijack, TLS Strip | DAI, DHCP Snooping, DNSSEC, RPKI/ROA, HSTS, Certificate Transparency, Encryption everywhere |
| Replay Attack | Gửi lại gói tin hợp lệ đã bắt được | Nonce, Timestamp, Sequence Number, TLS Record Sequence, IPsec Anti-Replay Window |
| Session Hijacking / Fixation | Đánh cắp session ID/cookie | Secure/HttpOnly/SameSite Cookie, Short Session Timeout, MFA, Token Binding |
| DNS Tunneling / Data Exfil | Đóng gói data trong DNS query/response | DNS Firewall, Query Length Limit, Entropy Analysis, Block Unknown TLD |
| Routing Attacks | BGP Hijack, Route Leak, RIP/OSPF Spoof | RPKI/ROV, BGPsec, Prefix Filtering, Max-Prefix, Auth (MD5/SHA), TTLP Security |
| VLAN Hopping | Double Tagging, Switch Spoofing | Native VLAN không dùng, Disable DTP, Port Security, Private VLAN |
Chuẩn bị thi CISSP Domain 4 (Tips)
- Nắm vững OSI/TCP-IP Model mapping security controls per layer.
- Hiểu Zero Trust Architecture (NIST SP 800-207) – không tin cậy mặc định, verify explicitly, least privilege, assume breach.
- Phân biệt Policy vs Mechanism vs Assurance.
- Case study: Thiết kế mạng an toàn cho merger/acquisition, cloud migration, OT/IT convergence.
- Sử dụng tài liệu: Official (ISC)² CISSP CBK Reference, Sunflower Notes, Kelly Handerhan (Cybrary), Destination CISSP (Rob Witcher), Practice tests (Boson, Pearson, CCCure).