STEVEN LEVY BUSINESS 11.19.2019 08:00 AM Google Shakes Up Its 'TGIF'—and Ends Its Culture of Openness Amid leaks and protests, CEO Sundar Pichai is drastically shrinking the company-wide meeting that was once a symbol of Google's idealism. STEVEN LEVY BUSINESS 11.19.2019 08:00 AM Google Shakes Up Its 'TGIF'—and Ends Its Culture of Openness Amid leaks and protests, CEO Sundar Pichai is drastically shrinking the company-wide meeting that was once a symbol of Google's idealism. SUBSCRIBE Google Shakes Up Its 'TGIF'—and Ends Its Cult… Saved to Dropbox • Nov 19, 2019 at 8:12 PM https://www.wired.com/story/google-shakes-up-its-tgif-and-ends-its-culture-of-openness/?fbclid=IwAR1-ZOFGAUmSpaASp8sWfEgubJvckh_dfxuHDF-GWc0ti6iU87GbwH8KIjY&mbid=social_facebook&utm_brand=wired&utm_medium=social&utm_social-type=owned&utm_source=facebook https://www.wired.com/ https://subscribe.wired.com/subscribe/splits/wired/HCL_WIR_FAILSAFE?source=HCL_WIR_GLOBAL_NAV_DRAWER_FAILSAFE_0 https://www.wired.com/category/business/ https://www.wired.com/category/culture/ https://www.wired.com/category/gear/ https://www.wired.com/category/ideas/ https://www.wired.com/category/science/ https://www.wired.com/category/security/ https://www.wired.com/category/transportation/ https://www.wired.com/contributor/steven-levy https://www.wired.com/category/business Last week, Google CEO Sundar Pichai sent an email blast to his 100,000 or so employees, cutting back the company’s defining all-hands meeting known as TGIF. The famous free-for-alls had epitomized the company’s egalitarian ethos, a place where employees and leaders could talk freely about nearly anything. More recently, however, the biweekly meeting had become fraught as it increasingly reflected Google’s tensions as opposed to its aspirations. “It’s not working in its current form,” Pichai said of what was once the hallmark of Google culture. In 2020, he declared, the ​PHOTOGRAPH: JENS GYARMATY/REDUX Last week, Google CEO Sundar Pichai sent an email blast to his 100,000 or so employees, cutting back the company’s defining all-hands meeting known as TGIF. The famous free-for-alls had epitomized the company’s egalitarian ethos, a place where employees and leaders could talk freely about nearly anything. More recently, however, the biweekly meeting had become fraught as it increasingly reflected Google’s tensions as opposed to its aspirations. “It’s not working in its current form,” Pichai said of what was once the hallmark of Google culture. In 2020, he declared, the ​PHOTOGRAPH: JENS GYARMATY/REDUX Last week, Google CEO Sundar Pichai sent an email blast to his 100,000 or so employees, cutting back the company’s defining all-hands meeting known as TGIF. The famous free-for-alls had epitomized the company’s egalitarian ethos, a place where employees and leaders could talk freely about nearly anything. More recently, however, the biweekly meeting had become fraught as it increasing.

1. STEVEN LEVY
BUSINESS 11.19.2019 08:00 AM
Google Shakes Up
Its 'TGIF'—and Ends
Its Culture of
Openness
Amid leaks and protests, CEO
Sundar Pichai is drastically
shrinking the company-wide
meeting that was once a symbol of
Google's idealism.
STEVEN LEVY
BUSINESS 11.19.2019 08:00 AM
Google Shakes Up
Its 'TGIF'—and Ends
Its Culture of
Openness
Amid leaks and protests, CEO
Sundar Pichai is drastically
shrinking the company-wide
meeting that was once a symbol of
Google's idealism.
SUBSCRIBE
Google Shakes Up Its 'TGIF'—and Ends Its Cult…
Saved to Dropbox • Nov 19, 2019 at 8:12 PM

2. https://www.wired.com/story/google-shakes-up-its-tgif-and-
ends-its-culture-of-openness/?fbclid=IwAR1-
ZOFGAUmSpaASp8sWfEgubJvckh_dfxuHDF-
GWc0ti6iU87GbwH8KIjY&mbid=social_facebook&utm_brand=
wired&utm_medium=social&utm_social-
type=owned&utm_source=facebook
https://www.wired.com/
https://subscribe.wired.com/subscribe/splits/wired/HCL_WIR_F
AILSAFE?source=HCL_WIR_GLOBAL_NAV_DRAWER_FAIL
SAFE_0
https://www.wired.com/category/business/
https://www.wired.com/category/culture/
https://www.wired.com/category/gear/
https://www.wired.com/category/ideas/
https://www.wired.com/category/science/
https://www.wired.com/category/security/
https://www.wired.com/category/transportation/
https://www.wired.com/contributor/steven-levy
https://www.wired.com/category/business
Last week, Google CEO Sundar Pichai sent
an email blast to his 100,000 or so
employees, cutting back the company’s
defining all-hands meeting known as
TGIF. The famous free-for-alls had
epitomized the company’s egalitarian
ethos, a place where employees and

3. leaders could talk freely about nearly
anything. More recently, however, the
biweekly meeting had become fraught as
it increasingly reflected Google’s tensions
as opposed to its aspirations. “It’s not
working in its current form,” Pichai said of
what was once the hallmark of Google
culture. In 2020, he declared, the
PHOTOGRAPH: JENS GYARMATY/REDUX
Last week, Google CEO Sundar Pichai sent
an email blast to his 100,000 or so
employees, cutting back the company’s
defining all-hands meeting known as
TGIF. The famous free-for-alls had
epitomized the company’s egalitarian
ethos, a place where employees and
leaders could talk freely about nearly
anything. More recently, however, the

4. biweekly meeting had become fraught as
it increasingly reflected Google’s tensions
as opposed to its aspirations. “It’s not
working in its current form,” Pichai said of
what was once the hallmark of Google
culture. In 2020, he declared, the
PHOTOGRAPH: JENS GYARMATY/REDUX
Last week, Google CEO Sundar Pichai sent
an email blast to his 100,000 or so
employees, cutting back the company’s
defining all-hands meeting known as
TGIF. The famous free-for-alls had
epitomized the company’s egalitarian
ethos, a place where employees and
leaders could talk freely about nearly
anything. More recently, however, the
biweekly meeting had become fraught as
it increasingly reflected Google’s tensions

5. as opposed to its aspirations. “It’s not
working in its current form,” Pichai said of
what was once the hallmark of Google
culture. In 2020, he declared, the
PHOTOGRAPH: JENS GYARMATY/REDUX
https://www.wired.com/tag/google/
https://www.theverge.com/2019/11/15/20966718/google-
weekly-all-hands-tgif-staff-meeting-changes-ceo-sundar-pichai
https://www.wired.com/story/inside-google-three-years-misery-
happiest-company-tech/
meetings would be limited to once a
month, and they would be more
constrained affairs, sticking to “product
and business strategy.” Don’t Be Evil has
changed to Don’t Ask Me Anything.
With that, Pichai not only ended an era at
Google, he symbolically closed the
shutters on a dream held widely in the
tech world—that one can scale a company
to global ubiquity while maintaining the

6. camaraderie of an idealistic clan.
Pichai cited decreased attendance rates,
the difficulty of running a real-time
gathering across time zones, and an
uptick in meetings among big product
groups like Cloud or YouTube. His most
resonant reason, however, was that
Google employees could no longer be
trusted to keep matters confidential. He
cited “a coordinated effort to share our
conversations outside of the company
meetings would be limited to once a
month, and they would be more
constrained affairs, sticking to “product
and business strategy.” Don’t Be Evil has
changed to Don’t Ask Me Anything.
With that, Pichai not only ended an era at
Google, he symbolically closed the

7. shutters on a dream held widely in the
tech world—that one can scale a company
to global ubiquity while maintaining the
camaraderie of an idealistic clan.
Pichai cited decreased attendance rates,
the difficulty of running a real-time
gathering across time zones, and an
uptick in meetings among big product
groups like Cloud or YouTube. His most
resonant reason, however, was that
Google employees could no longer be
trusted to keep matters confidential. He
cited “a coordinated effort to share our
conversations outside of the company
after every TGIF ... it has affected our
ability to use TGIF as a forum for candid
conversations on important topics.” He

8. also noted that while many want to hear
about product launches and business
strategies, some attend to “hear answers
on other topics.” It seems obvious he was
referring to recent moments when
aggrieved employees registered objections
to Google’s policies and missteps—on
developing a search engine for China,
bestowing millions of dollars to executives
charged with sexual misconduct, or hiring
a former Homeland Security apparatchik.
Pichai says Google may address such
issues in specific town-hall meetings
when warranted.
Google isn’t the only company to rein in
its fora because not everyone on its team
is on its team. Facebook recently had its
own issues with its weekly all-hands,

9. where Mark Zuckerberg fields questions
after every TGIF ... it has affected our
ability to use TGIF as a forum for candid
conversations on important topics.” He
also noted that while many want to hear
about product launches and business
strategies, some attend to “hear answers
on other topics.” It seems obvious he was
referring to recent moments when
aggrieved employees registered objections
to Google’s policies and missteps—on
developing a search engine for China,
bestowing millions of dollars to executives
charged with sexual misconduct, or hiring
a former Homeland Security apparatchik.
Pichai says Google may address such
issues in specific town-hall meetings
when warranted.

10. Google isn’t the only company to rein in
its fora because not everyone on its team
is on its team. Facebook recently had its
own issues with its weekly all-hands,
where Mark Zuckerberg fields questions
https://www.wired.com/story/inside-google-three-years-misery-
happiest-company-tech/
https://www.wired.com/story/wired-25-sundar-pichai-china-
censored-search-engine/
https://www.wsj.com/articles/google-agreed-to-pay-135-
million-to-two-executives-accused-of-sexual-harassment-
11552334653
https://www.washingtonpost.com/technology/2019/10/25/google
-ceo-leaked-video-says-company-is-genuinely-struggling-with-
employee-trust/
from his own far-flung workforce. A July
session of its weekly meeting leaked to
Casey Newton of The Verge, who
published it in its entirety. Zuckerberg not
only acknowledged the authenticity of the
leak but, on very little notice, decided to
publicly live-stream the next week’s all-

11. hands. Which sort of meant that it was no
longer an internal meeting, but a kind of
performance version of one. Facebook,
too, is reconsidering its all-hands strategy.
You need to enable JavaScript to run this app.
The loss of TGIF is huge. The ability to ask
the boss any question in a timely fashion
from his own far-flung workforce. A July
session of its weekly meeting leaked to
Casey Newton of The Verge, who
published it in its entirety. Zuckerberg not
only acknowledged the authenticity of the
leak but, on very little notice, decided to
publicly live-stream the next week’s all-
hands. Which sort of meant that it was no
longer an internal meeting, but a kind of
performance version of one. Facebook,
too, is reconsidering its all-hands strategy.

12. You need to enable JavaScript to run this app.
The loss of TGIF is huge. The ability to ask
the boss any question in a timely fashion
from his own far-flung workforce. A July
session of its weekly meeting leaked to
Casey Newton of The Verge, who
published it in its entirety. Zuckerberg not
only acknowledged the authenticity of the
leak but, on very little notice, decided to
publicly live-stream the next week’s all-
hands. Which sort of meant that it was no
longer an internal meeting, but a kind of
performance version of one. Facebook,
too, is reconsidering its all-hands strategy.
You need to enable JavaScript to run this app.
The loss of TGIF is huge. The ability to ask
the boss any question in a timely fashion
https://www.theverge.com/2019/10/1/20892354/mark-

13. zuckerberg-full-transcript-leaked-facebook-meetings
was a powerful symbol of employee
empowerment. The practice began when
Google was relatively tiny, as a relaxed
session—beer was served!—where
cofounders Larry Page and Sergey Brin
took queries, no matter how challenging,
from anyone who cared to ask. The
company even invented an app that
allowed employees to rank potential
questions, so pressing ones would get
precedence.
ADVERTISEMENT
was a powerful symbol of employee
empowerment. The practice began when
Google was relatively tiny, as a relaxed
session—beer was served!—where
cofounders Larry Page and Sergey Brin

14. took queries, no matter how challenging,
from anyone who cared to ask. The
company even invented an app that
allowed employees to rank potential
questions, so pressing ones would get
precedence.
ADVERTISEMENT
When I was writing a book about Google
some years ago, I sat in on several TGIFs,
held in the cavernous Charlie’s Cafe on
the Mountain View campus. They followed
a format that became a template for
dozens of new companies thereafter. First
was a welcoming ceremony of new
employees (at peak a few dozen of them
might attend), who were required to wear
their “Noogler” beanies—colorful caps

15. with plastic propellers on top. Then there
would be news and announcements,
followed by a presentation or demo by
one or more groups. A new product or
policy initiative might get announced,
even if its real-world unveiling was
months off. The company was confident
that news would not leak out, and it
didn’t. (For example, Google shared
information that it was working on its
own browser, Chrome, over a year before
it actually launched.)
As Google grew, TGIF evolved. Originally a
When I was writing a book about Google
some years ago, I sat in on several TGIFs,
held in the cavernous Charlie’s Cafe on
the Mountain View campus. They followed
a format that became a template for

16. dozens of new companies thereafter. First
was a welcoming ceremony of new
employees (at peak a few dozen of them
might attend), who were required to wear
their “Noogler” beanies—colorful caps
with plastic propellers on top. Then there
would be news and announcements,
followed by a presentation or demo by
one or more groups. A new product or
policy initiative might get announced,
even if its real-world unveiling was
months off. The company was confident
that news would not leak out, and it
didn’t. (For example, Google shared
information that it was working on its
own browser, Chrome, over a year before
it actually launched.)
As Google grew, TGIF evolved. Originally a

17. https://www.amazon.com/Plex-Google-Thinks-Works-
Shapes/dp/1416596585/ref=tmm_hrd_swatch_0?_encoding=UTF
8&qid=&sr=
Friday afternoon end-of-week
celebration, several years ago it moved to
Thursdays so that those across the globe
wouldn’t have to tune in on the weekend.
And about a year ago it switched from
weekly to biweekly. But very little else
changed. Even as they did fewer public
appearances, cofounders Larry Page and
Sergey Brin regularly led the sessions. The
friendly audience relaxed them, and they
joked their way through things. More
recently, when Page and Brin officially
became Alphabet executives and Pichai
ran the TGIFs, they would still sometimes
drop in—kind of a Proof of Life that the

18. executives, especially the publicity-shy
Page, were still around.
Though Google didn’t invent the
phenomenon of a weekly all-hands, the
success of TGIF made it a much-emulated
practice. Facebook held its meeting from
the start; Zuckerberg would end by
Friday afternoon end-of-week
celebration, several years ago it moved to
Thursdays so that those across the globe
wouldn’t have to tune in on the weekend.
And about a year ago it switched from
weekly to biweekly. But very little else
changed. Even as they did fewer public
appearances, cofounders Larry Page and
Sergey Brin regularly led the sessions. The
friendly audience relaxed them, and they
joked their way through things. More

19. recently, when Page and Brin officially
became Alphabet executives and Pichai
ran the TGIFs, they would still sometimes
drop in—kind of a Proof of Life that the
executives, especially the publicity-shy
Page, were still around.
Though Google didn’t invent the
phenomenon of a weekly all-hands, the
success of TGIF made it a much-emulated
practice. Facebook held its meeting from
the start; Zuckerberg would end by
Friday afternoon end-of-week
celebration, several years ago it moved to
Thursdays so that those across the globe
wouldn’t have to tune in on the weekend.
And about a year ago it switched from
weekly to biweekly. But very little else
changed. Even as they did fewer public

20. appearances, cofounders Larry Page and
Sergey Brin regularly led the sessions. The
friendly audience relaxed them, and they
joked their way through things. More
recently, when Page and Brin officially
became Alphabet executives and Pichai
ran the TGIFs, they would still sometimes
drop in—kind of a Proof of Life that the
executives, especially the publicity-shy
Page, were still around.
Though Google didn’t invent the
phenomenon of a weekly all-hands, the
success of TGIF made it a much-emulated
practice. Facebook held its meeting from
the start; Zuckerberg would end by
shouting “Domination!” Twitter had a
version called Tea Time. You’d probably

21. be hard pressed to find a successful
startup or unicorn that didn’t have such a
session. What made the weekly all-hands
so attractive was its power to bind a
workforce to a shared mission. The fact
that such meetings could continue when
the head count reached five figures and
more reflected a crazy optimism that, with
the right kind of culture, the physics of
corporate alienation could be defied.
ADVERTISEMENT
shouting “Domination!” Twitter had a
version called Tea Time. You’d probably
be hard pressed to find a successful
startup or unicorn that didn’t have such a
session. What made the weekly all-hands
so attractive was its power to bind a
workforce to a shared mission. The fact

22. that such meetings could continue when
the head count reached five figures and
more reflected a crazy optimism that, with
the right kind of culture, the physics of
corporate alienation could be defied.
ADVERTISEMENT
Now we’ve learned—no surprise—that
physics wins. The big problems of these
big companies have led employees to
more aggressively question their bosses,
and in some cases even sabotage them by
leaking the secrets shared in these
meetings. As any reader of spy novels can
tell you, the presence of moles in an
organization is a morale-killer. It also
harshes the corporate mellow when
workers use putatively feel-good

23. meetings to stage hostile confrontations
with their leaders on an increasing
number of sore points. In earlier times,
employees tended to express their gripes
with the expectation that leaders and
workers were colleagues, too evolved to
get hung up on power disparities. Now,
with giant corporations worrying more
about market dominance and regulators
than about feel-good missions, that
kumbaya sensibility is gone.
That’s why, when Google said Thank
Now we’ve learned—no surprise—that
physics wins. The big problems of these
big companies have led employees to
more aggressively question their bosses,
and in some cases even sabotage them by
leaking the secrets shared in these

24. meetings. As any reader of spy novels can
tell you, the presence of moles in an
organization is a morale-killer. It also
harshes the corporate mellow when
workers use putatively feel-good
meetings to stage hostile confrontations
with their leaders on an increasing
number of sore points. In earlier times,
employees tended to express their gripes
with the expectation that leaders and
workers were colleagues, too evolved to
get hung up on power disparities. Now,
with giant corporations worrying more
about market dominance and regulators
than about feel-good missions, that
kumbaya sensibility is gone.
That’s why, when Google said Thank

25. Goodness It’s Finished, it ended a lot more
than a weekly meeting. Winter has come
to Silicon Valley. And no beer for you.
More Great WIRED
Stories
The influencer scientists debunking
online misinformation
Do we need a special language to
talk to aliens?
These researchers are trying to build
a better blockchain
New emoji are so boring, but they
don't have to be
This jet can now land itself, no pilot
needed
� A safer way to protect your data;
plus, check out the latest news on AI
� Torn between the latest phones?
Never fear—check out our iPhone

26. buying guide and favorite Android
phones
Goodness It’s Finished, it ended a lot more
than a weekly meeting. Winter has come
to Silicon Valley. And no beer for you.
More Great WIRED
Stories
The influencer scientists debunking
online misinformation
Do we need a special language to
talk to aliens?
These researchers are trying to build
a better blockchain
New emoji are so boring, but they
don't have to be
This jet can now land itself, no pilot
needed
� A safer way to protect your data;

27. plus, check out the latest news on AI
� Torn between the latest phones?
Never fear—check out our iPhone
buying guide and favorite Android
phones
Goodness It’s Finished, it ended a lot more
than a weekly meeting. Winter has come
to Silicon Valley. And no beer for you.
More Great WIRED
Stories
The influencer scientists debunking
online misinformation
Do we need a special language to
talk to aliens?
These researchers are trying to build
a better blockchain
New emoji are so boring, but they
don't have to be
This jet can now land itself, no pilot

28. needed
� A safer way to protect your data;
plus, check out the latest news on AI
� Torn between the latest phones?
Never fear—check out our iPhone
buying guide and favorite Android
phones
https://www.wired.com/story/youtube-misinformation-
scientists/?itm_campaign=BottomRelatedStories_Sections_4
https://www.wired.com/story/do-we-need-a-special-language-to-
talk-to-aliens/?itm_campaign=BottomRelatedStories_Sections_4
https://www.wired.com/story/researchers-trying-build-better-
blockchain/?itm_campaign=BottomRelatedStories_Sections_4
https://www.wired.com/story/why-unicode-keeps-adding-
boring-emoji/?itm_campaign=BottomRelatedStories_Sections_4
https://www.wired.com/story/cirrus-garmin-vision-jet-autoland-
safe-return/?itm_campaign=BottomRelatedStories_Sections_4
https://www.wired.com/story/dawn-song-oasis-labs-data-
privacy-
wired25/?itm_campaign=BottomRelatedStories_Sections_4
https://www.wired.com/category/business/artificial-
intelligence/?itm_campaign=BottomRelatedStories_Sections_4
https://wired.com/gallery/iphone-buying-
guide/?itm_campaign=BottomRelatedStories
https://wired.com/gallery/best-android-
phones/?itm_campaign=BottomRelatedStories

29. Steven Levy covers the gamut of tech subjects for
WIRED, in print and online, and has been
contributing to the magazine since its inception.
He has been writing about technology for more
than 30 years, writing columns for Rolling Stone
and Macworld; leading technology coverage for
Newsweek; and cocreating a... Read more
EDITOR AT LARGE
FEATURED VIDEO
WIRED25: Google CEO Sundar Pichai on
Doing Business in China, Working with
the Military, and More
Steven Levy covers the gamut of tech subjects for
WIRED, in print and online, and has been
contributing to the magazine since its inception.
He has been writing about technology for more
than 30 years, writing columns for Rolling Stone
and Macworld; leading technology coverage for
Newsweek; and cocreating a... Read more
EDITOR AT LARGE
FEATURED VIDEO
WIRED25: Google CEO Sundar Pichai on
Doing Business in China, Working with
the Military, and More

30. https://www.wired.com/contributor/steven-levy
https://www.wired.com/contributor/steven-levy
https://www.wired.com/contributor/steven-levy
https://www.twitter.com/StevenLevy
http://video.wired.com/watch/google-ceo-sundar-pichai-at-
wired25
TOPICS GOOGLE SUNDAR PICHAI
MORE FROM WIRED
To See the Future of Disinformation,
You Build Robo-Trolls
TOM SIMONITE
TOPICS GOOGLE SUNDAR PICHAI
MORE FROM WIRED
To See the Future of Disinformation,
You Build Robo-Trolls
TOM SIMONITE
TOPICS GOOGLE SUNDAR PICHAI
MORE FROM WIRED
To See the Future of Disinformation,
You Build Robo-Trolls
TOM SIMONITE
https://www.wired.com/tag/google

31. https://www.wired.com/tag/sundar-pichai
https://www.wired.com/story/to-see-the-future-of-
disinformation-you-build-robo-
trolls#intcid=recommendations_wired-bottom-recirc-
similar_a536c491-703e-4624-81a4-353f4add3dad_cral-top2-2
https://www.wired.com/story/to-see-the-future-of-
disinformation-you-build-robo-
trolls#intcid=recommendations_wired-bottom-recirc-
similar_a536c491-703e-4624-81a4-353f4add3dad_cral-top2-2
https://www.wired.com/story/the-apple-card-didnt-see-
genderand-thats-the-problem#intcid=recommendations_wired-
bottom-recirc-similar_a536c491-703e-4624-81a4-
353f4add3dad_cral-top2-2
The Apple Card Didn't 'See' Gender
—and That's the Problem
WILL KNIGHT
Microtasks Might Be the Future of
White-Collar Work
CLIVE THOMPSON
The Apple Card Didn't 'See' Gender
—and That's the Problem
WILL KNIGHT
Microtasks Might Be the Future of
White-Collar Work
CLIVE THOMPSON
https://www.wired.com/story/the-apple-card-didnt-see-

32. genderand-thats-the-problem#intcid=recommendations_wired-
bottom-recirc-similar_a536c491-703e-4624-81a4-
353f4add3dad_cral-top2-2
https://www.wired.com/story/the-apple-card-didnt-see-
genderand-thats-the-problem#intcid=recommendations_wired-
bottom-recirc-similar_a536c491-703e-4624-81a4-
353f4add3dad_cral-top2-2
https://www.wired.com/story/microtasks-future-of-white-collar-
work#intcid=recommendations_wired-bottom-recirc-
similar_a536c491-703e-4624-81a4-353f4add3dad_cral-top2-2
https://www.wired.com/story/microtasks-future-of-white-collar-
work#intcid=recommendations_wired-bottom-recirc-
similar_a536c491-703e-4624-81a4-353f4add3dad_cral-top2-2
https://www.wired.com/story/startups-prepare-for-
downfall#intcid=recommendations_wired-bottom-recirc-
similar_a536c491-703e-4624-81a4-353f4add3dad_cral-top2-2
Every Startup Needs to Prepare for
Its Downfall
ARIELLE PARDES
AI For Good Is Often Bad
MARK LATONERO
Every Startup Needs to Prepare for
Its Downfall
ARIELLE PARDES
AI For Good Is Often Bad
MARK LATONERO

33. https://www.wired.com/story/startups-prepare-for-
downfall#intcid=recommendations_wired-bottom-recirc-
similar_a536c491-703e-4624-81a4-353f4add3dad_cral-top2-2
https://www.wired.com/story/startups-prepare-for-
downfall#intcid=recommendations_wired-bottom-recirc-
similar_a536c491-703e-4624-81a4-353f4add3dad_cral-top2-2
https://www.wired.com/story/opinion-ai-for-good-is-often-
bad#intcid=recommendations_wired-bottom-recirc-
similar_a536c491-703e-4624-81a4-353f4add3dad_cral-top2-2
https://www.wired.com/story/opinion-ai-for-good-is-often-
bad#intcid=recommendations_wired-bottom-recirc-
similar_a536c491-703e-4624-81a4-353f4add3dad_cral-top2-2
https://www.wired.com/story/why-is-google-slow-walking-its-
breakthroughs-in-ai#intcid=recommendations_wired-bottom-
recirc-similar_a536c491-703e-4624-81a4-353f4add3dad_cral-
top2-2
Why Is Google Slow-Walking Its
Breakthroughs in AI?
TOM SIMONITE
Every Tech Company Wants to Be a
Bank—Someday, At Least
GREGORY BARBER
Why Is Google Slow-Walking Its
Breakthroughs in AI?
TOM SIMONITE
Every Tech Company Wants to Be a
Bank—Someday, At Least

34. GREGORY BARBER
Why Is Google Slow-Walking Its
Breakthroughs in AI?
TOM SIMONITE
Every Tech Company Wants to Be a
Bank—Someday, At Least
GREGORY BARBER
https://www.wired.com/story/why-is-google-slow-walking-its-
breakthroughs-in-ai#intcid=recommendations_wired-bottom-
recirc-similar_a536c491-703e-4624-81a4-353f4add3dad_cral-
top2-2
https://www.wired.com/story/why-is-google-slow-walking-its-
breakthroughs-in-ai#intcid=recommendations_wired-bottom-
recirc-similar_a536c491-703e-4624-81a4-353f4add3dad_cral-
top2-2
https://www.wired.com/story/tech-companies-
banks#intcid=recommendations_wired-bottom-recirc-
similar_a536c491-703e-4624-81a4-353f4add3dad_cral-top2-2
https://www.wired.com/story/tech-companies-
banks#intcid=recommendations_wired-bottom-recirc-
similar_a536c491-703e-4624-81a4-353f4add3dad_cral-top2-2
https://www.wired.com/story/instagram-business-accounts-
analytics#intcid=recommendations_wired-bottom-recirc-
similar_a536c491-703e-4624-81a4-353f4add3dad_cral-top2-2
Chasing Instagram Analytics,
People are Becoming Grocery
Stores, Cruise Lines, and More
LOUISE MATSAKIS

35. SPONSORED STORIESSPONSORED STORIES
WWW.EASYQUIZES.COM
Quiz For Tinnitus Ringing In Ears
ONLINE COLLEGE | SPONSORED LINKS
Online Colleges Are Finally Lowering
Costs | Search Today
ENERGY BILL CRUNCHER
California: You Should Get Solar
Panels Immediately If You Own A
Home In These Zip Codes
LIFESUM
The keto diet app that is going to
change your life
FINANCEJOURNAL24.COM
Born Before 1985? Gov't Will Pay
$271/Month Off Your Mortgage If You
Qualify
CELEBSPULSE
20 Vintage Ads That Would Never Be
Allowed Today
Chasing Instagram Analytics,
People are Becoming Grocery

36. Stores, Cruise Lines, and More
LOUISE MATSAKIS
SPONSORED STORIESSPONSORED STORIES
WWW.EASYQUIZES.COM
Quiz For Tinnitus Ringing In Ears
ONLINE COLLEGE | SPONSORED LINKS
Online Colleges Are Finally Lowering
Costs | Search Today
ENERGY BILL CRUNCHER
California: You Should Get Solar
Panels Immediately If You Own A
Home In These Zip Codes
LIFESUM
The keto diet app that is going to
change your life
FINANCEJOURNAL24.COM
Born Before 1985? Gov't Will Pay
$271/Month Off Your Mortgage If You
Qualify
CELEBSPULSE
20 Vintage Ads That Would Never Be
Allowed Today

37. https://www.wired.com/story/instagram-business-accounts-
analytics#intcid=recommendations_wired-bottom-recirc-
similar_a536c491-703e-4624-81a4-353f4add3dad_cral-top2-2
https://paid.outbrain.com/network/redir?p=WaeS5BpBCa-
lxNpTPlksDuxjtBeI8B9WLDMzPfu0yXCyJsI5Iw2AwMnff2JJ9
NQ-Z0MckveFeqoy-
0pYx_ho2zeRpaph6QcoAVstL8wnxko8L4rropcpWvCtqDuvf1flr
ljaZ3fg54C5TqdrVd_a83LE3mY2101D4IPUqoDpE4x91qR9lM0
hNb8E-lsgZ-R3BbMgOWKTPtpOKfPhQqI-
QRFvFrjmqg5J4My9jy7JUyyIXWAKnchN8FzpoQ1ycDnun3X1
WCcowvlkGZ0jKIiIDfluyiDqIPv9GNNz9qHQ5Puue9zPo30waI4
F3t5xDd3YsC81giVJVEMNCiTj_X3k170yip8PiToyxGgsDEr5Q
zXFBJqyRMP8FYDYSDKG_DCUgbmndS1z0Uqvmbb2hYgiSKy
Wm_mRWZ0xt9p1YGM6Y0JTknYgxaSjMsWwM5EMHjiaeetvr
q1p-i50-_-
eNLmNb3Kzx_YqOW0jWNnEJdECbF8lhnPe4t6o_LdK4wjw4K
q3DKhDNjcuR6rMYHTOCxfZJ1BuH-
qImxyx7YaiMN69BYQTCj5_9uXVGfh-
eMjOGH5RZWtIKzdlViWuwRaXX2d5cy6dgdbctYqWr5K05sy
Ws8GwaInXI5qA9Txv17-Eml4ntqurDwqsRVSM9URaGI-
xybjdzlUtiuazWKmRli-
nIs4u2rbidYHrngTMLZAby1EFvo7cDORkoA1vBzzWZNs6zant
wf_45hUSOicVeEtcFQG09gw4goq6V5dGuV4hcsr4J12KFwF0b
1OT8av8EEWB-VFKe5waiF-
Rz8Xf_LU3fCWzsT5G4RySU6b2TzFtAyEItOfChzs0Bx19D_Yl
xeruiAiKIdgvdbjd6W8zq-Jnme0BhQN-
MDqxyD6NHdHz_DtPzw8ndAbqfdb_Vq4MiinxCEQrzS9sy0Inol
XMmfzXgOJE8cGdiUL-
AbpebZaa_22xtwC4mI3Lja_d_gb9SZAjyvzpW0RW0AtMzaz67S
3EYyXxmuvxzpeDkhiXnHMhVwTesMAPQMzyyTykxm7EOrEk
97dL7ELigTjyHWsdnpmh-kzhTm04PFHrMkhlbE_xPWU9V3-
O89xJgkohcbYfKRJpOI1JIf3JV0MoT8Op0hYugGd7iZvCnftJ5C
1V5UygGEDvfSGCSguEQ8yaI49X2FfF3fDOFfAUqjRihxev4i3k
_ki2LpYyHFr7kvSdSrvK3AdbjlSpcuncjTDy01i84cWacTzQFIKa
Oq-Z6OOVXAZ7-qPk6JKUwQSrKAbjICMZKJJO8MIl326Z-

38. oAcG2M_w193drZ05Siz12VNGFLgcREKV2w&c=a710ba65&v
=3
…
(ISC)2
CISSP® Certified Information
Systems Security Professional
Official Study Guide
Eighth Edition
Mike Chapple
James Michael Stewart
Darril Gibson
Development Editor: Kelly Talbot
Technical Editors: Jeff Parker, Bob Sipes, and David Seidl
Copy Editor: Kim Wimpsett
Editorial Manager: Pete Gaughan
Production Manager: Kathleen Wisor

39. Executive Editor: Jim Minatel
Proofreader: Amy Schneider
Indexer: Johnna VanHoose Dinse
Project Coordinator, Cover: Brent Savage
Cover Designer: Wiley
Cover Image: @Jeremy Woodhouse/Getty Images, Inc.
Copyright © 2018 by John Wiley & Sons, Inc., Indianapolis,
Indiana
Published simultaneously in Canada
ISBN: 978-1-119-47593-4
ISBN: 978-1-119-47595-8 (ebk.)
ISBN: 978-1-119-47587-3 (ebk.)
Manufactured in the United States of America
No part of this publication may be reproduced, stored in a
retrieval system or transmitted in
any form or by any means, electronic, mechanical,
photocopying, recording, scanning or
otherwise, except as permitted under Sections 107 or 108 of the
1976 United States Copyright
Act, without either the prior written permission of the
Publisher, or authorization through
payment of the appropriate per-copy fee to the Copyright
Clearance Center, 222 Rosewood
Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-

40. 8600. Requests to the Publisher
for permission should be addressed to the Permissions
Department, John Wiley & Sons, Inc.,
111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax
(201) 748-6008, or online at
http://www.wiley.com/go/permissions.
Limit of Liability/Disclaimer of Warranty: The publisher and
the author make no
representations or warranties with respect to the accuracy or
completeness of the contents of
this work and specifically disclaim all warranties, including
without limitation warranties of
fitness for a particular purpose. No warranty may be created or
extended by sales or
promotional materials. The advice and strategies contained
herein may not be suitable for
every situation. This work is sold with the understanding that
the publisher is not engaged in
rendering legal, accounting, or other professional services. If
professional assistance is
required, the services of a competent professional person should
be sought. Neither the
publisher nor the author shall be liable for damages arising
herefrom. The fact that an
organization or Web site is referred to in this work as a citation
and/or a potential source of
further information does not mean that the author or the
publisher endorses the information
the organization or Web site may provide or recommendations it
may make. Further, readers
should be aware that Internet Web sites listed in this work may
have changed or disappeared
between when this work was written and when it is read.
For general information on our other products and services or to

41. obtain technical support,
please contact our Customer Care Department within the U.S. at
(877) 762-2974, outside the
http://www.wiley.com/go/permissions
U.S. at (317) 572-3993 or fax (317) 572-4002.
Wiley publishes in a variety of print and electronic formats and
by print-on-demand. Some
material included with standard print versions of this book may
not be included in e-books or
in print-on-demand. If this book refers to media such as a CD or
DVD that is not included in
the version you purchased, you may download this material at
http://booksupport.wiley.com.
For more information about Wiley products, visit
www.wiley.com.
Library of Congress Control Number: 2018933561
TRADEMARKS: Wiley, the Wiley logo, and the Sybex logo are
trademarks or registered
trademarks of John Wiley & Sons, Inc. and/or its affiliates, in
the United States and other
countries, and may not be used without written permission.
CISSP is a registered trademark of
(ISC)², Inc. All other trademarks are the property of their
respective owners. John Wiley &
Sons, Inc. is not associated with any product or vendor
mentioned in this book.
http://booksupport.wiley.com
http://www.wiley.com

42. To Dewitt Latimer, my mentor, friend, and colleague. I miss
you
dearly.
—Mike Chapple
To Cathy, your perspective on the world and life often surprises
me,
challenges me, and makes me love you even more.
—James Michael Stewart
To Nimfa, thanks for sharing your life with me for the past 26
years
and letting me share mine with you.
—Darril Gibson
Dear Future (ISC)2 Member,
Congratulations on starting your journey to
CISSP® certification. Earning your CISSP is an
exciting and rewarding milestone in your
cybersecurity career. Not only does it demonstrate
your ability to develop and manage nearly all
aspects of an organization’s cybersecurity
operations, but you also signal to employers your
commitment to life-long learning and taking an
active role in fulfilling the (ISC)² vision of
inspiring a safe and secure cyber world.
The material in this study guide is based upon the (ISC)² CISSP
Common Body of Knowledge. It will help you prepare for the
exam
that will assess your competency in the following eight

43. domains:
Security and Risk Management
Asset Security
Security Architecture and Engineering
Communication and Network Security
Identity and Access Management (IAM)
Security Assessment and Testing
Security Operations
Software Development Security
While this study guide will help you prepare, passing the CISSP
exam
depends on your mastery of the domains combined with your
ability to
apply those concepts using your real-world experience.
I wish you the best of luck as you continue on your path to
become a
CISSP and certified member of (ISC)2.
Sincerely,
David Shearer, CISSP
CEO
(ISC)2

44. Acknowledgments
We’d like to express our thanks to Sybex for continuing to
support this
project. Extra thanks to the eighth edition developmental editor,
Kelly
Talbot, and technical editors, Jeff Parker, Bob Sipes, and David
Seidl,
who performed amazing feats in guiding us to improve this
book.
Thanks as well to our agent, Carole Jelen, for continuing to
assist in
nailing down these projects.
—Mike, James, and Darril
Special thanks go to the information security team at the
University of
Notre Dame, who provided hours of interesting conversation
and
debate on security issues that inspired and informed much of the
material in this book.
I would like to thank the team at Wiley who provided invaluable
assistance throughout the book development process. I also owe
a debt
of gratitude to my literary agent, Carole Jelen of Waterside
Productions. My coauthors, James Michael Stewart and Darril
Gibson,
were great collaborators. Jeff Parker, Bob Sipes, and David
Seidl, our
diligent and knowledgeable technical editors, provided valuable
in-
sight as we brought this edition to press.

45. I’d also like to thank the many people who participated in the
production of this book but whom I never had the chance to
meet: the
graphics team, the production staff, and all of those involved in
bringing this book to press.
—Mike Chapple
Thanks to Mike Chapple and Darril Gibson for continuing to
contribute to this project. Thanks also to all my CISSP course
students
who have provided their insight and input to improve my
training
courseware and ultimately this tome. To my adoring wife,
Cathy:
Building a life and a family together has been more wonderful
than I
could have ever imagined. To Slayde and Remi: You are
growing up so
fast and learning at an outstanding pace, and you continue to
delight
and impress me daily. You are both growing into amazing
individuals.
To my mom, Johnnie: It is wonderful to have you close by. To
Mark:
No matter how much time has passed or how little we see each
other, I
have been and always will be your friend. And finally, as
always, to
Elvis: You were way ahead of the current bacon obsession with
your
peanut butter/banana/bacon sandwich; I think that’s proof you
traveled through time!

46. —James Michael Stewart
Thanks to Jim Minatel and Carole Jelen for helping get this
update in
place before (ISC)2 released the objectives. This helped us get a
head
start on this new edition, and we appreciate your efforts. It’s
been a
pleasure working with talented people like James Michael
Stewart and
Mike Chapple. Thanks to both of you for all your work and
collaborative efforts on this project. The technical editors, Jeff
Parker,
Bob Sipes, and David Seidl, provided us with some outstanding
feedback, and this book is better because of their efforts.
Thanks to the
team at Sybex (including project managers, editors, and
graphics
artists) for all the work you did helping us get this book to
print. Last,
thanks to my wife, Nimfa, for putting up with my odd hours as I
worked on this book.
—Darril Gibson
About the Authors
Mike Chapple, CISSP, PhD, Security+, CISA, CySA+, is an
associate
teaching professor of IT, analytics, and operations at the
University of
Notre Dame. In the past, he was chief information officer of
Brand
Institute and an information security researcher with the

47. National
Security Agency and the U.S. Air Force. His primary areas of
expertise
include network intrusion detection and access controls. Mike is
a
frequent contributor to TechTarget’s SearchSecurity site and the
author of more than 25 books including the companion book to
this
study guide: CISSP Official (ISC)2 Practice Tests, the
CompTIA CSA+
Study Guide, and Cyberwarfare: Information Operations in a
Connected World. Mike offers study groups for the CISSP,
SSCP,
Security+, and CSA+ certifications on his website at
www.certmike.com.
James Michael Stewart, CISSP, CEH, ECSA, CHFI, Security+,
Network+, has been writing and training for more than 20 years,
with
a current focus on security. He has been teaching CISSP
training
courses since 2002, not to mention other courses on Internet
security
and ethical hacking/penetration testing. He is the author of and
contributor to more than 75 books and numerous courseware
sets on
security certification, Microsoft topics, and network
administration,
including the Security+ (SY0-501) Review Guide. More
information
about Michael can be found at his website at
www.impactonline.com.
Darril Gibson, CISSP, Security+, CASP, is the CEO of YCDA
(short
for You Can Do Anything), and he has authored or coauthored

48. more
than 40 books. Darril regularly writes, consults, and teaches on
a wide
variety of technical and security topics and holds several
certifications.
He regularly posts blog articles at
http://blogs.getcertifiedgetahead.com/ about certification topics
and
uses that site to help people stay abreast of changes in
certification
exams. He loves hearing from readers, especially when they
pass an
exam after using one of his books, and you can contact him
through
the blogging site.
http://www.certmike.com
http://www.impactonline.com
http://blogs.getcertifiedgetahead.com/
About the Technical Editors
Jeff T. Parker, CISSP, is a technical editor and reviewer across
many
focuses of information security. Jeff regularly contributes to
books,
adding experience and practical know-how where needed. Jeff’s
experience comes from 10 years of consulting with Hewlett-
Packard in
Boston and from 4 years with Deutsche-Post in Prague, Czech
Republic. Now residing in Canada, Jeff teaches his and other
middle-
school kids about building (and destroying) a home lab. He
recently
coauthored Wireshark for Security Professionals and is now
authoring CySA+ Practice Exams. Keep learning!

49. Bob Sipes, CISSP, is an enterprise security architect and
account
security officer at DXC Technology providing tactical and
strategic
leadership for DXC clients. He holds several certifications, is
actively
involved in security organizations including ISSA and
Infragard, and is
an experienced public speaker on topics including
cybersecurity,
communications, and leadership. In his spare time, Bob is an
avid
antiquarian book collector with an extensive library of 19th and
early
20th century boys’ literature. You can follow Bob on Twitter at
@bobsipes.
David Seidl, CISSP, is the senior director for Campus
Technology
Services at the University of Notre Dame, where he has also
taught
cybersecurity and networking in the Mendoza College of
Business.
David has written multiple books on cybersecurity certification
and
cyberwarfare, and he has served as the technical editor for the
sixth,
seventh, and eighth editions of CISSP Study Guide. David holds
a
master’s degree in information security and a bachelor’s degree
in
communication technology from Eastern Michigan University,
as well
as CISSP, GPEN, GCIH, and CySA+ certifications.

50. Contents
Introduction
Overview of the CISSP Exam
Notes on This Book’s Organization
Assessment Test
Answers to Assessment Test
Chapter 1 Security Governance Through Principles and Policies
Understand and Apply Concepts of Confidentiality, Integrity,
and Availability
Evaluate and Apply Security Governance Principles
Develop, Document, and Implement Security Policy, Standards,
Procedures, and Guidelines
Understand and Apply Threat Modeling Concepts and
Methodologies
Apply Risk-Based Management Concepts to the Supply Chain
Summary
Exam Essentials
Written Lab
Review Questions
Chapter 2 Personnel Security and Risk Management Concepts
Personnel Security Policies and Procedures
Security Governance
Understand and Apply Risk Management Concepts
Establish and Maintain a Security Awareness, Education, and
Training Program
Manage the Security Function
Summary
Exam Essentials
Written Lab

51. Review Questions
Chapter 3 Business Continuity Planning
Planning for Business Continuity
Project Scope and Planning
Business Impact Assessment
Continuity Planning
Plan Approval and Implementation
Summary
Exam Essentials
Written Lab
Review Questions
Chapter 4 Laws, Regulations, and Compliance
Categories of Laws
Laws
Compliance
Contracting and Procurement
Summary
Exam Essentials
Written Lab
Review Questions
Chapter 5 Protecting Security of Assets
Identify and Classify Assets
Determining Ownership
Using Security Baselines
Summary
Exam Essentials
Written Lab
Review Questions
Chapter 6 Cryptography and Symmetric Key Algorithms

52. Historical Milestones in Cryptography
Cryptographic Basics
Modern Cryptography
Symmetric Cryptography
Cryptographic Lifecycle
Summary
Exam Essentials
Written Lab
Review Questions
Chapter 7 PKI and Cryptographic Applications
Asymmetric Cryptography
Hash Functions
Digital Signatures
Public Key Infrastructure
Asymmetric Key Management
Applied Cryptography
Cryptographic Attacks
Summary
Exam Essentials
Written Lab
Review Questions
Chapter 8 Principles of Security Models, Design, and
Capabilities
Implement and Manage Engineering Processes Using Secure
Design Principles
Understand the Fundamental Concepts of Security Models
Select Controls Based On Systems Security Requirements
Understand Security Capabilities of Information Systems
Summary
Exam Essentials

53. Written Lab
Review Questions
Chapter 9 Security Vulnerabilities, Threats, and
Countermeasures
Assess and Mitigate Security Vulnerabilities
Client-Based Systems
Server-Based Systems
Database Systems Security
Distributed Systems and Endpoint Security
Internet of Things
Industrial Control Systems
Assess and Mitigate Vulnerabilities in Web-Based Systems
Assess and Mitigate Vulnerabilities in Mobile Systems
Assess and Mitigate Vulnerabilities in Embedded Devices and
Cyber-Physical Systems
Essential Security Protection Mechanisms
Common Architecture Flaws and Security Issues
Summary
Exam Essentials
Written Lab
Review Questions
Chapter 10 Physical Security Requirements
Apply Security Principles to Site and Facility Design
Implement Site and Facility Security Controls
Implement and Manage Physical Security
Summary
Exam Essentials
Written Lab
Review Questions
Chapter 11 Secure Network Architecture and Securing Network
Components

54. OSI Model
TCP/IP Model
Converged Protocols
Wireless Networks
Secure Network Components
Cabling, Wireless, Topology, Communications, and
Transmission Media Technology
Summary
Exam Essentials
Written Lab
Review Questions
Chapter 12 Secure Communications and Network Attacks
Network and Protocol Security Mechanisms
Secure Voice Communications
Multimedia Collaboration
Manage Email Security
Remote Access Security Management
Virtual Private Network
Virtualization
Network Address Translation
Switching Technologies
WAN Technologies
Miscellaneous Security Control Characteristics
Security Boundaries
Prevent or Mitigate Network Attacks
Summary
Exam Essentials
Written Lab
Review Questions
Chapter 13 Managing Identity and Authentication

55. Controlling Access to Assets
Comparing Identification and Authentication
Implementing Identity Management
Managing the Identity and Access Provisioning Lifecycle
Summary
Exam Essentials
Written Lab
Review Questions
Chapter 14 Controlling and Monitoring Access
Comparing Access Control Models
Understanding Access Control Attacks
Summary
Exam Essentials
Written Lab
Review Questions
Chapter 15 Security Assessment and Testing
Building a Security Assessment and Testing Program
Performing Vulnerability Assessments
Testing Your Software
Implementing Security Management Processes
Summary
Exam Essentials
Written Lab
Review Questions
Chapter 16 Managing Security Operations
Applying Security Operations Concepts
Securely Provisioning Resources
Managing Configuration
Managing Change
Managing Patches and Reducing Vulnerabilities

56. Summary
Exam Essentials
Written Lab
Review Questions
Chapter 17 Preventing and Responding to Incidents
Managing Incident Response
Implementing Detective and Preventive Measures
Logging, Monitoring, and Auditing
Summary
Exam Essentials
Written Lab
Review Questions
Chapter 18 Disaster Recovery Planning
The Nature of Disaster
Understand System Resilience and Fault Tolerance
Recovery Strategy
Recovery Plan Development
Training, Awareness, and Documentation
Testing and Maintenance
Summary
Exam Essentials
Written Lab
Review Questions
Chapter 19 Investigations and Ethics
Investigations
Major Categories of Computer Crime
Ethics
Summary
Exam Essentials
Written Lab

57. Review Questions
Chapter 20 Software Development Security
Introducing Systems Development Controls
Establishing Databases and Data Warehousing
Storing Data and Information
Understanding Knowledge-Based Systems
Summary
Exam Essentials
Written Lab
Review Questions
Chapter 21 Malicious Code and Application Attacks
Malicious Code
Password Attacks
Application Attacks
Web Application Security
Reconnaissance Attacks
Masquerading Attacks
Summary
Exam Essentials
Written Lab
Review Questions
Appendix A Answers to Review Questions
Chapter 1: Security Governance Through Principles and Policies
Chapter 2: Personnel Security and Risk Management Concepts
Chapter 3: Business Continuity Planning
Chapter 4: Laws, Regulations, and Compliance
Chapter 5: Protecting Security of Assets
Chapter 6: Cryptography and Symmetric Key Algorithms
Chapter 7: PKI and Cryptographic Applications
Chapter 8: Principles of Security Models, Design, and

58. Capabilities
Chapter 9: Security Vulnerabilities, Threats, and
Countermeasures
Chapter 10: Physical Security Requirements
Chapter 11: Secure Network Architecture and Securing Network
Components
Chapter 12: Secure Communications and Network Attacks
Chapter 13: Managing Identity and Authentication
Chapter 14: Controlling and Monitoring Access
Chapter 15: Security Assessment and Testing
Chapter 16: Managing Security Operations
Chapter 17: Preventing and Responding to Incidents
Chapter 18: Disaster Recovery Planning
Chapter 19: Investigations and Ethics
Chapter 20: Software Development Security
Chapter 21: Malicious Code and Application Attacks
Appendix B Answers to Written Labs
Chapter 1: Security Governance Through Principles and Policies
Chapter 2: Personnel Security and Risk Management Concepts
Chapter 3: Business Continuity Planning
Chapter 4: Laws, Regulations, and Compliance
Chapter 5: Protecting Security of Assets
Chapter 6: Cryptography and Symmetric Key Algorithms
Chapter 7: PKI and Cryptographic Applications
Chapter 8: Principles of Security Models, Design, and
Capabilities
Chapter 9: Security Vulnerabilities, Threats, and
Countermeasures
Chapter 10: Physical Security Requirements
Chapter 11: Secure Network Architecture and Securing Network
Components
Chapter 12: Secure Communications and Network Attacks

59. Chapter 13: Managing Identity and Authentication
Chapter 14: Controlling and Monitoring Access
Chapter 15: Security Assessment and Testing
Chapter 16: Managing Security Operations
Chapter 17: Preventing and Responding to Incidents
Chapter 18: Disaster Recovery Planning
Chapter 19: Investigations and Ethics
Chapter 20: Software Development Security
Chapter 21: Malicious Code and Application Attacks
Advert
EULA
List of Tables
Chapter 2
Table 2.1
Table 2.2
Chapter 5
Table 5.1
Table 5.2
Table 5.3
Chapter 6
Table 6.1
Table 6.2

60. Chapter 7
Table 7.1
Chapter 8
Table 8.1
Table 8.2
Table 8.3
Table 8.4
Chapter 9
Table 9.1
Chapter 10
Table 10.1
Table 10.2
Chapter 11
Table 11.1
Table 11.2
Table 11.3
Table 11.4

61. Table 11.5
Table 11.6
Table 11.7
Table 11.8
Table 11.9
Table 11.10
Table 11.11
Chapter 12
Table 12.1
Table 12.2
Table 12.3
Table 12.4
Chapter 18
Table 18.1
List of Illustrations
Chapter 1
FIGURE 1.1 The CIA Triad
FIGURE 1.2 The five elements of AAA services

62. FIGURE 1.3 Strategic, tactical, and operational plan timeline
comparison
FIGURE 1.4 Levels of government/military classification
FIGURE 1.5 Commercial business/private sector classification
levels
FIGURE 1.6 The comparative relationships of security policy
components
FIGURE 1.7 An example of diagramming to reveal threat
concerns
FIGURE 1.8 An example of diagramming to reveal threat
concerns
Chapter 2
FIGURE 2.1 An example of separation of duties related to five
admin tasks and seven administrators
FIGURE 2.2 An example of job rotation among management
positions
FIGURE 2.3 Ex-employees must return all company property
FIGURE 2.4 The elements of risk
FIGURE 2.5 The six major elements of quantitative risk
analysis
FIGURE 2.6 The categories of security controls in a defense-
in-depth implementation

63. FIGURE 2.7 The six steps of the risk management framework
Chapter 3
FIGURE 3.1 Earthquake hazard map of the United States
Chapter 5
FIGURE 5.1 Data classifications
FIGURE 5.2 Clearing a hard drive
Chapter 6
FIGURE 6.1 Challenge-response authentication protocol
FIGURE 6.2 The magic door
FIGURE 6.3 Symmetric key cryptography
FIGURE 6.4 Asymmetric key cryptography
Chapter 7
FIGURE 7.1 Asymmetric key cryptography
FIGURE 7.2 Steganography tool
FIGURE 7.3 Image with embedded message
Chapter 8
FIGURE 8.1 The TCB, security perimeter, and reference
monitor

64. FIGURE 8.2 The Take-Grant model’s directed graph
FIGURE 8.3 The Bell-LaPadula model
FIGURE 8.4 The Biba model
FIGURE 8.5 The Clark-Wilson model
FIGURE 8.6 The levels of TCSEC
Chapter 9
FIGURE 9.1 In the commonly used four-ring model,
protection rings segregate the operating system into kernel,
components, and drivers in rings 0 through 2 and applications
and programs run at ring 3.
FIGURE 9.2 The process scheduler
Chapter 10
FIGURE 10.1 A typical wiring closet
FIGURE 10.2 The fire triangle
FIGURE 10.3 The four primary stages of fire
FIGURE 10.4 A secure physical boundary with a mantrap and
a turnstile
Chapter 11
FIGURE 11.1 Representation of the OSI model

65. FIGURE 11.2 Representation of OSI model encapsulation
FIGURE 11.3 Representation of the OSI model peer layer
logical channels
FIGURE 11.4 OSI model data names
FIGURE 11.5 Comparing the OSI model with the TCP/IP
model
FIGURE 11.6 The four layers of TCP/IP and its component
protocols
FIGURE 11.7 The TCP three-way handshake
FIGURE 11.8 Single-, two-, and three-tier firewall deployment
architectures
FIGURE 11.9 A ring topology
FIGURE 11.10 A linear bus topology and a tree bus topology
FIGURE 11.11 A star topology
FIGURE 11.12 A mesh topology
Chapter 13
FIGURE 13.1 Graph of FRR and FAR errors indicating the
CER point
Chapter 14

66. FIGURE 14.1 Defense in depth with layered security
FIGURE 14.2 Role Based Access Control
FIGURE 14.3 A representation of the boundaries provided by
lattice-based access controls
FIGURE 14.4 Wireshark capture
Chapter 15
FIGURE 15.1 Nmap scan of a web server run from a Linux
system
FIGURE 15.2 Default Apache server page running on the
server scanned in Figure 15.1
FIGURE 15.3 Nmap scan of a large network run from a Mac
system using the Terminal utility
FIGURE 15.4 Network vulnerability scan of the same web
server that was port scanned in Figure 15.1
FIGURE 15.5 Web application vulnerability scan of the same
web server that was port scanned in Figure 15.1 and network
vulnerability scanned in Figure 15.2.
FIGURE 15.6 Scanning a database-backed application with
sqlmap
FIGURE 15.7 Penetration testing process
FIGURE 15.8 The Metasploit automated system exploitation
tool allows attackers to quickly execute common attacks against
target systems.

67. FIGURE 15.9 Fagan inspections follow a rigid formal process,
with defined entry and exit criteria that must be met before
transitioning between stages.
FIGURE 15.10 Prefuzzing input file containing a series of 1s
FIGURE 15.11 The input file from Figure 15.10 after being run
through the zzuf mutation fuzzing tool
Chapter 16
FIGURE 16.1 A segregation of duties control matrix
FIGURE 16.2 Creating and deploying images
FIGURE 16.3 Web server and database server
Chapter 17
FIGURE 17.1 Incident response
FIGURE 17.2 SYN flood attack
FIGURE 17.3 A man-in-the-middle attack
FIGURE 17.4 Intrusion prevention system
FIGURE 17.5 Viewing a log entry
Chapter 18
FIGURE 18.1 Flood hazard map for Miami–Dade County,
Florida

68. FIGURE 18.2 Failover cluster with network load balancing
Chapter 20
FIGURE 20.1 Security vs. user-friendliness vs. functionality
FIGURE 20.2 The waterfall lifecycle model
FIGURE 20.3 The spiral lifecycle mode
FIGURE 20.4 The IDEAL model
FIGURE 20.5 Gantt chart
FIGURE 20.6 The DevOps model
FIGURE 20.7 Hierarchical data model
FIGURE 20.8 Customers table from a relational database
FIGURE 20.9 ODBC as the interface between applications
and a backend database system
Chapter 21
FIGURE 21.1 Social Security phishing message
FIGURE 21.2 Typical database-driven website architecture
kindle:embed:0007?mime=image/jpg
Introduction
The (ISC)2 CISSP: Certified Information Systems Security
Professional Official Study Guide, Eighth Edition, offers you a
solid

69. foundation for the Certified Information Systems Security
Professional
(CISSP) exam. By purchasing this book, you’ve shown a
willingness to
learn and a desire to develop the skills you need to achieve this
certification. This introduction provides you with a basic
overview of
this book and the CISSP exam.
This book is designed for readers and students who want to
study for
the CISSP certification exam. If your goal is to become a
certified
security professional, then the CISSP certification and this
study guide
are for you. The purpose of this book is to adequately prepare
you to
take the CISSP exam.
Before you dive into this book, you need to have accomplished
a few
tasks on your own. You need to have a general understanding of
IT
and of security. You should have the necessary five years of
full-time
paid work experience (or four years if you have a college
degree) in two
or more of the eight domains covered by the CISSP exam. If
you are
qualified to take the CISSP exam according to (ISC)2, then you
are
sufficiently prepared to use this book to study for it. For more
information on (ISC)2, see the next section.
(ISC)2 also allows for a one-year reduction of the five-year
experience

70. requirement if you have earned one of the approved
certifications from
the (ISC)2 prerequisite pathway. These include certifications
such as
CAP, CISM, CISA, CCNA Security, Security+, MCSA, MCSE,
and many
of the GIAC certifications. For a complete list of qualifying
certifications, visit
https://www.isc2.org/Certifications/CISSP/Prerequisite-
Pathway.
Note: You can use only one of the experience reduction
measures,
either a college degree or a certification, not both.
(ISC)2
https://www.isc2.org/Certifications/CISSP/Prerequisite-Pathway
The CISSP exam is governed by the International Information
Systems
Security Certification Consortium (ISC)2. (ISC)2 is a global
not-for-
profit organization. It has four primary mission goals:
Maintain the Common Body of Knowledge (CBK) for the field
of
information systems security.
Provide certification for information systems security
professionals
and practitioners.
Conduct certification training and administer the certification
exams.

71. Oversee the ongoing accreditation of qualified certification
candidates through continued education.
The (ISC)2 is operated by a board of directors elected from the
ranks of
its certified practitioners.
(ISC)2 supports and provides a wide variety of certifications,
including
CISSP, SSCP, CAP, CSSLP, CCFP, HCISPP, and CCSP. These
certifications are designed to verify the knowledge and skills of
IT
security professionals across all industries. You can obtain more
information about (ISC)2 and its other certifications from its
website
at www.isc2.org.
The Certified Information Systems Security Professional
(CISSP)
credential is for security professionals responsible for designing
and
maintaining security infrastructure within an organization.
Topical Domains
The CISSP certification covers material from the eight topical
domains. These eight domains are as follows:
Security and Risk Management
Asset Security
Security Architecture and Engineering
Communication and Network Security
Identity and Access Management (IAM)

72. …
______
The Grounded 737 Max Is Turning Into a Major Debacle
for Boeing
BY BLOOMBERG 8:11 AM EDT
Boeing tumbled early Monday on heightened scrutiny by
regulators and
prosecutors over whether the approval process for the
company’s 737 Max
jetliner was flawed.
A person familiar with the matter on Sunday said that the U.S.
Transportation
Department’s Inspector General was examining the plane’s
design certification
before the second of two deadly crashes of the almost brand-
new aircraft.
Separately, the Wall Street Journal reported that a grand jury in
Washington,
D.C., on March 11 issued a subpoena to at least one person
involved in the
development process of the Max. And a Seattle Times

73. investigation found that
U.S. regulators delegated much of the plane’s safety assessment
to Boeing and
that the company in turn delivered an analysis with crucial
flaws.
Boeing dropped 2.8 percent to $368.53 before the start of
regular trading
Monday in New York, well below any closing price since the
deadly crash of
Ethiopian Airlines Flight 302 on March 10. Ethiopia’s transport
minister said
Sunday that flight-data recorders showed “clear similarities”
between the
crashes of that plane and Lion Air Flight 610 last October.
The Brief Newsletter
Sign up to receive the top stories you need to know right now.
View Sample
http://time.com/author/bloomberg/
http://time.com/newsletter/the-brief/
http://time.com/
Read more: Q&A on Boeing’s 737 Max crisis
U.S. Federal Aviation Administration employees warned as
early as seven years

74. ago that Boeing had too much sway over safety approvals of
new aircraft,
prompting an investigation by Transportation Department
auditors who
confirmed the agency hadn’t done enough to “hold Boeing
accountable.”
The 2012 investigation also found that discord over Boeing’s
treatment had
created a “negative work environment” among FAA employees
who approve
new and modified aircraft designs, with many of them saying
they’d faced
retaliation for speaking up. Their concerns pre-dated the 737
Max
development.
In recent years, the FAA has shifted more authority over the
approval of new
aircraft to the manufacturer itself, even allowing Boeing to
choose many of the
personnel who oversee tests and vouch for safety. Just in the
past few months,
Congress expanded the outsourcing arrangement even further.
“It raises for me the question of whether the agency is properly

75. funded,
properly staffed and whether there has been enough independent
oversight,”
said Jim Hall, who was chairman of the National Transportation
Safety Board
from 1994 to 2001 and is now an aviation-safety consultant.
Outsourcing Safety
At least a portion of the flight-control software suspected in the
737 Max
crashes was certified by one or more Boeing employees who
worked in the
outsourcing arrangement, according to one person familiar with
the work who
wasn’t authorized to speak about the matter.
SIGN UP NOW
https://pages.email.time.com/newsletters/?newsletter_name=the
_brief&source=shortcode
The Wall Street Journal first reported the inspector general’s
latest inquiry. The
watchdog is trying to assess whether the FAA used appropriate
design
standards and engineering analysis in approving the 737 Max’s

76. anti-stall
system, the newspaper said.
Both Boeing and the Transportation Department declined to
comment about
that inquiry.
In a statement on Sunday, the agency said its “aircraft
certification processes
are well established and have consistently produced safe aircraft
designs,”
adding that the “737 Max certification program followed the
FAA’s standard
certification process.”
The Ethiopian Airlines plane crashed minutes after it took off
from Addis
Ababa, killing all 157 people on board. The accident prompted
most of the
world to ground Boeing’s 737 Max 8 aircraft on safety
concerns, coming on the
heels of the October crash of a Max 8 operated by Indonesia’s
Lion Air that
killed 189 people. Much of the attention focused on a flight-
control system
that can automatically push a plane into a catastrophic nose dive

77. if it
malfunctions and pilots don’t react properly.
In one of the most detailed descriptions yet of the relationship
between Boeing
and the FAA during the 737 Max’s certification, the Seattle
Times quoted
unnamed engineers who said the planemaker had understated the
power of the
flight-control software in a System Safety Analysis submitted to
the FAA. The
newspaper said the analysis also failed to account for how the
system could
reset itself each time a pilot responded — in essence, gradually
ratcheting the
horizontal stabilizer into a dive position.
Software Fix
Boeing told the newspaper in a statement that the FAA had
reviewed the
company’s data and concluded the aircraft “met all certification
and regulatory
requirements.” The company, which is based in Chicago but
designs and builds

78. commercial jets in the Seattle area, said there are “some
significant
mischaracterizations” in the engineers’ comments.
In a separate statement Sunday, Boeing Chief Executive Officer
Dennis
Muilenburg reiterated the company’s sympathies for the
affected families and
support for the investigation into the flight-control system,
known as the
Maneuvering Characteristics Augmentation System.
“While investigators continue to work to establish definitive
conclusions,
Boeing is finalizing its development of a previously announced
software update
and pilot training revision that will address the MCAS flight-
control law’s
behavior in response to erroneous sensor inputs,” Muilenburg
said.
The newspaper also quoted unnamed FAA technical experts who
said managers
prodded them to speed up the certification process as
development of the Max
was nine months behind that of rival Airbus SE’s A320neo.

79. The FAA has let technical experts at aircraft makers act as its
representatives
to perform certain tests and approve some parts for decades.
The FAA
expanded the scope of that program in 2005 to address concerns
about
adequately keeping pace with its workload. Known as
Organization Designation
Authorization, or ODA, it let Boeing and other manufacturers
choose the
employees who approve design work on the agency’s behalf.
Previously, the FAA approved each appointment. Under the new
approach,
which was fully implemented in 2009, the ODA representatives
are still under
U.S. legal requirements and the FAA has the authority to
oversee them and
request that their management be changed.
Anonymous Faxes
In 2012, a special investigator of the Office of Inspector
General at the

80. Department of Transportation sent a memo to the FAA’s audit
chief warning
him of concerns voiced by agency employees about the new
process. Some
allegations were made in anonymous faxes sent to the inspector
general’s
office, and the office followed up by interviewing employees in
the FAA’s
Transport Airplane Directorate.
“Our investigation substantiated employee allegations that TAD
and FAA
headquarters managers have not always supported TAD
employee efforts to
hold Boeing accountable and this has created a negative
atmosphere within the
TAD,” according to the June 22, 2012, report sent to the FAA.
(The memo was
made available later in a public records request and appears
now on a website
operated by governmentattic.org, which warehouses government
documents. A
spokesman for the inspector general’s office confirmed its
authenticity.)
The employees told the investigators that managers had

81. overturned a
recommendation by staff to remove the administrator Boeing
had chosen for
the program and “had not adequately addressed employees’
concerns” about
potential conflicts of interest, the memo said. The employees, it
said, viewed
this as evidence of management having “too close a relationship
with Boeing
officials.”
Despite those concerns, as well as others raised in a subsequent
report by the
inspector general, Congress has embraced the program as a way
to improve the
FAA’s efficiency.
President Donald Trump signed into law a change on Oct. 5. It
allows
manufacturers to request that the FAA eliminate limitations on
how company
representatives certify “low and medium risk” items, giving
them even more
authority over their own products.
The agency doesn’t have the budget to do every test, and “the

82. use of designees
is absolutely necessary,” said Steve Wallace, the former head of
accident
investigations at the FAA. “For the most part, it works
extremely well. There is
a very high degree of integrity in the system.”
Dreamliner Fires
But the program was also at issue in the FAA’s 2013 grounding
of Boeing’s 787
Dreamliner after two fires of battery packs. Boeing’s designated
engineering
representatives oversaw tests of the battery packs.
A 2015 report by the Department of Transportation’s inspector
general,
requested by U.S. Representative Peter DeFazio, found the FAA
lacked “an
effective staffing model” and “risk-based oversight process”
over the ODA
program.
DeFazio, an Oregon Democrat, now heads the House
transportation and

83. infrastructure committee, and has said he will conduct a
“rigorous
investigation” to make sure the FAA is protecting safety.
Hall, the former NTSB chairman, said the agency’s move to
shift power to the
manufacturers contributed to the unusual situation in which two
of Boeing’s
newly introduced aircraft were grounded in a period of six
years. Before the
Dreamliner, the FAA hadn’t grounded a model since 1979.
“When I was chairman of the NTSB, my single most important
job was who we
hired,” Hall said. “Do we have in the federal government the
level of funding
and expertise we need? Are we attracting the kind of young,
smart minds that
continue to uphold our reputation in the aviation area?”
As the investigation continues, mourners marched in the
hundreds past the
Library of Parliament in Addis Ababa to Selassie Cathedral for
a funeral service
Sunday, wearing black or the sea-green uniforms of Ethiopian
Airlines and

84. carrying photos of the dead. After a priest read the victims’
names aloud,
people carried empty coffins from the cathedral to a graveyard.
All that was
heard was sobbing, wailing and chanting.
Contact us at edit[email protected]
mailto:[email protected]?subject=(READER%20FEEDBACK)%
20The%20Grounded%20737%20Max%20Is%20Turning%20Into
%20a%20Major%20Debacle%20for%20Boeing