Page 940 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

Understand how email security works. Internet email is based
on SMTP, POP3, and IMAP. It is inherently insecure. It can be

secured, but the methods used must be addressed in a security policy.
Email security solutions include using S/MIME, MOSS, PEM, or PGP.

Know how fax security works. Fax security is primarily based on
using encrypted transmissions or encrypted communication lines to
protect the faxed materials. The primary goal is to prevent
interception. Activity logs and exception reports can be used to detect

anomalies in fax activity that could be symptoms of attack.
Know the threats associated with PBX systems and the

countermeasures to PBX fraud. Countermeasures to PBX fraud
and abuse include many of the same precautions you would employ to
protect a typical computer network: logical or technical controls,
administrative controls, and physical controls.

Understand the security issues related to VoIP. VoIP is at risk
for caller ID spoofing, vishing, SPIT, call manager software/firmware

attacks, phone hardware attacks, DoS, MitM, spoofing, and switch
hopping.

Recognize what a phreaker is. Phreaking is a specific type of
attack in which various types of technology are used to circumvent the
telephone system to make free long-distance calls, to alter the function
of telephone service, to steal specialized services, or even to cause
service disruptions. Common tools of phreakers include black, red,

blue, and white boxes.

Understand voice communications security. Voice
communications are vulnerable to many attacks, especially as voice
communications become an important part of network services. You
can obtain confidentiality by using encrypted communications.
Countermeasures must be deployed to protect against interception,
eavesdropping, tapping, and other types of exploitation. Be familiar

with voice communication topics, such as POTS, PSTN, PBX, and
VoIP.

Be able to explain what social engineering is. Social
engineering is a means by which an unknown person gains the trust of