Scribd
Upload
19 views

CISSP OVER ALL DOMAINS CONCEPT

The document outlines key concepts in security and risk management, including the CIA Triad, security governance principles, compliance, and risk management strategies. It covers asset security, security architecture, communication and network security, identity and access management, security assessment, operations, and software development security. Each section highlights essential practices, models, and tools necessary for effective security management.

Uploaded by

akparida09_850881076
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
19 views

CISSP OVER ALL DOMAINS CONCEPT

The document outlines key concepts in security and risk management, including the CIA Triad, security governance principles, compliance, and risk management strategies. It covers asset security, security architecture, communication and network security, identity and access management, security assessment, operations, and software development security. Each section highlights essential practices, models, and tools necessary for effective security management.

Uploaded by

akparida09_850881076
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 4

1.

Security and Risk Management

 CIA Triad: Confidentiality, Integrity, Availability.

 Security Governance Principles:

o Policies, Standards, Guidelines, and Procedures.

o Due care and due diligence.

 Compliance: Legal, regulatory, and industry standards (e.g., GDPR,


HIPAA, SOX).

 Risk Management:

o Risk = Threat × Vulnerability × Asset Value.

o Mitigation Strategies: Avoidance, Transfer, Mitigation,


Acceptance.

 Business Continuity (BC) & Disaster Recovery (DR):

o Business Impact Analysis (BIA), Recovery Time Objective


(RTO), Recovery Point Objective (RPO).

 Ethics: (ISC)² Code of Ethics – Protect society, act honorably, and


advance the profession.

2. Asset Security

 Data Classification: Public, Confidential, Private, Sensitive, etc.

 Data States: At rest, in transit, in use.

 Data Protection:

o Encryption (AES, RSA).

o Masking, Tokenization.

 Retention Policies: Define storage duration based on legal and


business needs.

 Media Management: Secure storage and disposal (shredding,


degaussing).

3. Security Architecture and Engineering

 Security Models:
o Bell-LaPadula: Confidentiality-focused (no read up, no write
down).

o Biba: Integrity-focused (no read down, no write up).

o Clark-Wilson: Integrity through separation of duties.

 Cryptography:

o Symmetric (AES, DES), Asymmetric (RSA, ECC), Hashing (SHA,


MD5).

o Key Management and PKI (Public Key Infrastructure).

 Security Controls:

o Preventive, Detective, Corrective.

o Physical, Technical, Administrative.

 Hardware/Software Security:

o Trusted Platform Module (TPM), Secure Boot.

o Sandboxing and Isolation.

4. Communication and Network Security

 Network Protocols:

o TCP/IP Model Layers: Application, Transport, Internet, Network


Access.

o Secure Protocols: HTTPS, TLS/SSL, IPsec, SFTP.

 Network Devices:

o Firewalls, IDS/IPS, Routers, Switches.

 Wireless Security:

o WPA3, WPA2, WEP (obsolete).

o Authentication Protocols (EAP, PEAP).

 Network Attacks:

o DDoS, Man-in-the-Middle (MITM), DNS Spoofing.

5. Identity and Access Management (IAM)


 Authentication: Something you know (password), have (token),
are (biometric).

 Authorization Models:

o Role-Based Access Control (RBAC), Mandatory Access Control


(MAC), Discretionary Access Control (DAC).

 Identity Federation: SSO, SAML, OAuth, OpenID Connect.

 Privileged Access Management (PAM):

o Least Privilege, Separation of Duties.

 Account Lifecycle:

o Provisioning, Monitoring, De-provisioning.

6. Security Assessment and Testing

 Vulnerability Assessment:

o Tools: Nessus, Qualys.

 Penetration Testing: Simulated attacks to find weaknesses.

 Testing Methods:

o Black Box, White Box, Gray Box.

 Security Audits:

o Evaluate effectiveness of controls.

 Metrics: Mean Time to Detect (MTTD), Mean Time to Repair (MTTR).

7. Security Operations

 Incident Management:

o Phases: Preparation, Detection, Containment, Eradication,


Recovery, Lessons Learned.

 Forensics:

o Chain of Custody, Evidence Handling.

 Disaster Recovery:

o Backup Types: Full, Incremental, Differential.

o Sites: Hot, Warm, Cold.


 Logging and Monitoring:

o SIEM (Security Information and Event Management).

o Threat Intelligence (Indicators of Compromise).

 Patch Management: Keeping systems updated.

8. Software Development Security

 Software Development Lifecycle (SDLC):

o Phases: Planning, Design, Implementation, Testing,


Deployment, Maintenance.

 Secure Coding:

o OWASP Top 10 (e.g., SQL Injection, XSS).

o Input Validation, Output Encoding.

 Testing:

o Static Analysis, Dynamic Analysis (e.g., Fuzzing).

 Secure Design Principles:

o Least Privilege, Defense in Depth, Fail Secure.

You might also like