Key Concepts 7.4 Apply foundational security operations concepts

Question 1

Involves limiting access to data and systems to only individuals with a legitimate business need for that information. This may result in denying access even to some with
necessary security clearance. This approach reduces risk from both external breaches and
unintentional (or malicious) insider actions.

Answer 1

Need-to-know

Question 2

Involves assigning the bare minimum permissions to accounts (user, system,
or service) required to perform their functions. This approach reduces lateral movement
opportunities for attackers and limits the impact of a single account’s compromise

Answer 2

Least privilege

Question 3

Refers to the gradual accumulation of unnecessary or excessive permissions granted to users, applications, or systems over time. This can lead to security vulnerabilities
and unauthorized access.

Answer 3

Privilege creep

Question 4

Involves dividing critical tasks or access roles to ensure one
person doesn’t hold excessive control, thus requiring collusion for fraud or abuse. This
approach prevents conflicts of interest, lowers financial risks, and enhances audit trails.

Answer 4

Segregation of Duties (SoD)

Question 5

is an agreement among multiple persons to perform some unauthorized or
illegal actions.

Answer 5

Collusion (SoD helps prevent)

Question 6

Is the use of deceitful tactics to gain unauthorized access to information systems,
data, or financial resources

Answer 6

Fraud (SoD helps prevent)

Question 7

Involves covertly obtaining confidential information, often for political, military, or economic advantage. Generally, initiated from outside and organization, but
may involve a malicious insider.

Answer 7

Espionage (SoD helps prevent)

Question 8

Which is a deliberate act or omission that damages or disrupts a company’s operations, property, or reputation. It can be carried out by employees, competitors, or
other outsiders.

Answer 8

Sabotage (SoD helps prevent)

Question 9

Involves a special focus on securing those accounts with administrative or higher-than-usual permissions. Is a system for managing, monitoring, and securing all accounts with elevated privileges, ideally regardless of the specific
technology stack in use.

Answer 9

Privileged account management (PAM)

Question 10

• Reduced attack surface: By limiting the number of active privileged accounts and their
  usage, PAM decreases potential entry points for attackers.
• Insider threat mitigation: By monitoring and controlling privileged access, PAM helps
  prevent misuse of power by internal users.
• Enhanced accountability: Clear tracking of who accessed what and when improves
  individual accountability within the organization.
• Protection against credential theft: JIT access and frequent password rotations make
  stolen credentials less valuable to attackers.
• Simplified access management: Centralized control over privileged roles and access
  streamlines administrative tasks and reduces human error.

Answer 10

Security Benefits of PAM

Question 11

involves periodically shifting employee roles and responsibilities within the organization. This approach detects anomalies or fraud more easily and spreads domain knowledge to reduce ‘single point of failure’ risks.

Answer 11

Job rotation

Question 12

are contracts defining performance, availability, and support expectations between customer and provider (usually an external vendor). Establish
security baselines and outline incident response timelines.

Answer 12

Service-level agreements (SLAs)

Question 13

An SLA between departments within an organization

Answer 13

operating level agreement (OLA)