CISSP Cheat Sheet Series

Domain 1: Security & Risk Management

CIA TriadAchieving CIA - Best Practices

Preserving authorized restrictions on information
access and disclosure, including means for protecting
personal privacy and proprietary information. Note –Encryption (At transit – TLS) (At rest - AES – 256)Conﬁdentiality

Separation Mandatoryof Duties
Vacations

Guarding against improper information modiﬁcation or
destruction and includes ensuring information
non-repudiation and authenticity.

Integrity

Ensuring timely and reliable access to and use ofinformation by authorized users.

Availability*Citation: https://www.isc2.org/Certiﬁcations/CISSP/CISSP-Student-Glossary

D.A.D.

Job
Rotation

Availability
Measuring Metrics

LeastPrivileges

Need toknow

Dual Control

RTO/MTD/RPO, MTBF, SLA

IAAAA
Identiﬁcation

Unique user identiﬁcation

Authentication

Validation of identiﬁcation

Authorization

Veriﬁcation of privileges and permissions forauthenticated user
Only authorized users are accessing and use thesystem accordingly

Disclosure

Alteration

Destruction

Accountability

Opposite ofConﬁdentiality

Opposite of Integrity

Opposite of Availability

Auditing

Plans

Tools, processes, and activities used to achieve andmaintain complianceProtection Mechanisms
LayeringAbstractions

Data Hiding

Encryption

TypeDuration

ExampleStrategic Plan

up to 5 Years

Risk Assessment

Tactical Plan

Maximum of 1 year

Project budget, staﬃng etc

Data classiﬁcation

Operational Plan

A few months

Patching computers
Updating AV signatures
Daily network administration

Entails analyzing the data that the organization retains, determining its
importance and value, and then assigning it to a category.

Risk Management●●●Risk Terminology

No risk can be completely avoided .
Risks can be minimized and controlled to avoid
impact of damages.
Risk management is the process of identifying,examining, measuring, mitigating, or transferring
risk

Asset

Anything of value to the company.

Vulnerability

A weakness; the absence of a safeguard

ThreatThings that could pose a risk to all or part of an asset

Threat Agent*Citation:https://resources.infosecinstitute.com/category/certiﬁcations-traini
ng/cissp/domains/security-and-risk-management/

The entity which carries out the attack

ExploitAn instance of compromise

Risk

The probability of a threat materializing*Citation:https://resources.infosecinstitute.com/category/certiﬁcations-training/cissp/domains/security-and-risk-management/

Solution – Keep risks at a tolerable and acceptable level.
Risk management constraints – Time, budget

Risk Management Frameworks
Preventive
Ex ISO 27001

Deterrent
Ex ISO 27000

Detective

Corrective

Recovery

Security Policies

Security PersonnelLogs

AlarmsBackupsSecurity Cameras

GuardsSecurity Cameras

Antivirus Solutions

Server Clustering

Callback

Security Cameras

Intrusion Detection Systems

Intrusion Detection Systems

Fault Tolerant Drive Systems

Security Awareness Training

Separation of Duties

Honey Pots

Business Continuity PlansDatabase Shadowing

Job Rotation

Intrusion Alarms

Audit Trails

Encryption

Awareness Training

Mandatory Vacations

Data Classiﬁcation

Firewalls

Smart Cards

Encryption

Antivirus Software

Risk Framework Types
Security and Risk Management
Asset Security

Risk Management Life Cycle
Assessment

Analysis

Mitigation / Response

Categorize, Classify & Evaluate
Assets

Qualitative vs Quantitative

Reduce, Transfer, Accept

as per NIST 800-30:

Qualitative – Judgments

Reduce / Avoid

System Characterization

Quantitative – Main terms

Transfer

Threat Identification

AV – Asset Value

Accept / Reject

Vulnerability Identification

EF – Exposure Factor

Control Analysis

ARO – Annual Rate of Occurrence
Single Loss Expectancy = AV * EF

Likelihood Determination

Identity and Access Management

Security Operations
Software Development Security

Security
GovernanceISO 17799 & 2700 Series

Risk Value = Probability * Impact

Risk Determination

Communications and Network Security

Security Assessment and Testing

BS 7799

Annual Loss Expectancy =SLE*ARO

Impact Analysis

Security Engineering

COBIT & COSO

The 6 Steps of the Risk
Management Framework
Categorize
SelectImplement
Asses

Control Recommendation

OCTAVEAuthorize

Results Documentation

ITILMonitor

Threat Identiﬁcation ModelsS.T.R.I.D.E.

Spoofing - Tampering - Repudiation - Information Disclosure - Denial of Service - Escalation of Privilege

D.R.E.A.D.

Damage - Reproducibility - Exploitability - Affected - Discoverability

M.A.R.T.

Mitigate - Accept - Reject - Transfer

Disaster Recovery /Business Continuity Plan

Criminal law

Continuity plan goals

Civil Law

Statement of importance

Administrative Law

Statement of priorities
Statement of organization
responsibility
Statement of urgency and timing
Risk assessment
Risk acceptance / mitigation

Types of Law

Comprehensive Crime Control Act (1984)
Computer Fraud and Abuse Act (1986)
Computer Security Act (1987)
Government Information Security Reform Act (2000)
Federal Information Security Management Act (2002)

Intellectual Property
Copyright
Trademarks
Patents
Trade Secrets
Licensing