Play It Safe: Manage Security Risks Flashcards
(36 cards)
Domain one: Security and risk management
Security goals and objectives, risk mitigation, compliance, business continuity, and the law
All organizations must develop their security posture. Security posture is an organization’s ability to manage its defense of critical assets and data and react to change. Elements of the security and risk management domain that impact an organization’s security posture include:
Security goals and objectives
Risk mitigation processes
Compliance
Business continuity plans
Legal regulations
Professional and organizational ethics
Information security, or InfoSec, is also related to this domain and refers to a set of processes established to secure information. An organization may use playbooks and implement training as a part of their security and risk management program, based on their needs and perceived risk. There are many InfoSec design processes, such as:
Incident response
Vulnerability management
Application security
Cloud security
Infrastructure security
As an example, a security team may need to alter how personally identifiable information (PII) is treated in order to adhere to the European Union’s General Data Protection Regulation (GDPR).
Domain two: Asset security
Securing assets; storage, maintenance, retention, and destruction of data
Asset security involves managing the cybersecurity processes of organizational assets, including the storage, maintenance, retention, and destruction of physical and virtual data. Because the loss or theft of assets can expose an organization and increase the level of risk, keeping track of assets and the data they hold is essential. Conducting a security impact analysis, establishing a recovery plan, and managing data exposure will depend on the level of risk associated with each asset. Security analysts may need to store, maintain, and retain data by creating backups to ensure they are able to restore the environment if a security incident places the organization’s data at risk.
Domain three: Security architecture and engineering
Optimizing data security by using effective tools, systems, and processes
This domain focuses on managing data security. Ensuring effective tools, systems, and processes are in place helps protect an organization’s assets and data. Security architects and engineers create these processes.
One important aspect of this domain is the concept of shared responsibility. Shared responsibility means all individuals involved take an active role in lowering risk during the design of a security system. Additional design principles related to this domain, which are discussed later in the program, include:
Threat modeling
Least privilege
Defense in depth
Fail securely
Separation of duties
Keep it simple
Zero trust
Trust but verify
An example of managing data is the use of a security information and event management (SIEM) tool to monitor for flags related to unusual login or user activity that could indicate a threat actor is attempting to access private data.
Domain four: Communication and network security
Managing and securing physical networks and wireless communications
This domain focuses on managing and securing physical networks and wireless communications. This includes on-site, remote, and cloud communications.
Organizations with remote, hybrid, and on-site work environments must ensure data remains secure, but managing external connections to make certain that remote workers are securely accessing an organization’s networks is a challenge. Designing network security controls—such as restricted network access—can help protect users and ensure an organization’s network remains secure when employees travel or work outside of the main office.
Domain five: Identity and access management
Using access, authorization, and established policies to secure data and manage assets
The identity and access management (IAM) domain focuses on keeping data secure. It does this by ensuring user identities are trusted and authenticated and that access to physical and logical assets is authorized. This helps prevent unauthorized users, while allowing authorized users to perform their tasks.
Domain six: Security assessment and testing
Conducting security control testing and audits, collecting and analyzing data
The security assessment and testing domain focuses on identifying and mitigating risks, threats, and vulnerabilities. Security assessments help organizations determine whether their internal systems are secure or at risk. Organizations might employ penetration testers, often referred to as “pen testers,” to find vulnerabilities that could be exploited by a threat actor.
This domain suggests that organizations conduct security control testing, as well as collect and analyze data. Additionally, it emphasizes the importance of conducting security audits to monitor for and reduce the probability of a data breach. To contribute to these types of tasks, cybersecurity professionals may be tasked with auditing user permissions to validate that users have the correct levels of access to internal systems.
Domain seven: Security operations
Conducting investigations and implementing preventative measures
The security operations domain focuses on the investigation of a potential data breach and the implementation of preventative measures after a security incident has occurred. This includes using strategies, processes, and tools such as:
Training and awareness
Reporting and documentation
Intrusion detection and prevention
SIEM tools
Log management
Incident management
Playbooks
Post-breach forensics
Reflecting on lessons learned
The cybersecurity professionals involved in this domain work as a team to manage, prevent, and investigate threats, risks, and vulnerabilities. These individuals are trained to handle active attacks, such as large amounts of data being accessed from an organization’s internal network, outside of normal working hours. Once a threat is identified, the team works diligently to keep private data and information safe from threat actors.
Domain eight: Software development security
Using secure coding practices to create secure applications and services
The software development security domain is focused on using secure programming practices and guidelines to create secure applications. Having secure applications helps deliver secure and reliable services, which helps protect organizations and their users.
Security must be incorporated into each element of the software development life cycle, from design and development to testing and release. To achieve security, the software development process must have security in mind at each step. Security cannot be an afterthought.
Performing application security tests can help ensure vulnerabilities are identified and mitigated accordingly. Having a system in place to test the programming conventions, software executables, and security measures embedded in the software is necessary. Having quality assurance and pen tester professionals ensure the software has met security and performance standards is also an essential part of the software development process. For example, an entry-level analyst working for a pharmaceutical company might be asked to make sure encryption is properly configured for a new medical device that will store private patient data.
Acceptance
Accepting a risk to avoid disrupting business continuity
Avoidance
Creating a plan to avoid the risk altogether
Transference
Transferring risk to a third party to manage
Mitigation
Lessening the impact of a known risk
Multiparty risk
Outsourcing work to third-party vendors can give them access to intellectual property, such as trade secrets, software designs, and inventions.
ProxyLogon
A pre-authenticated vulnerability that affects the Microsoft Exchange server. This means a threat actor can complete a user authentication process to deploy malicious code from a remote location.
ZeroLogon
A vulnerability in Microsoft’s Netlogon authentication protocol. An authentication protocol is a way to verify a person’s identity. Netlogon is a service that ensures a user’s identity before allowing access to a website’s location.
Log4Shell
Allows attackers to run Java code on someone else’s computer or leak sensitive information. It does this by enabling a remote attacker to take control of devices connected to the internet and run malicious code.
PetitPotam
Affects Windows New Technology Local Area Network (LAN) Manager (NTLM). It is a theft technique that allows a LAN-based attacker to initiate an authentication request.
Security logging and monitoring failures:
Insufficient logging and monitoring capabilities that result in attackers exploiting vulnerabilities without the organization knowing it
Fill in the blank: Security _____ refers to an organization’s ability to manage its defense of critical assets and data, as well as its ability to react to change.
governance
architecture
posture
hardening
posture
Which of the following examples are key focus areas of the security and risk management domain? Select three answers.
Maintain business continuity
Define security goals
Follow legal regulations
Conduct Control Testing
Maintain business continuity
Define security goals
Follow legal regulations
What term describes an organization’s ability to maintain its everyday productivity by establishing risk disaster recovery plans?
Business continuity
Mitigation
Daily defense
Recovery
Business continuity
Question 4
Fill in the blank: According to the concept of shared responsibility, employees can help lower risk to physical and virtual security by _____. Select two answers.
taking an active role
recognizing and reporting security concerns
meeting productivity goals
limiting their communication with team members
taking an active role
recognizing and reporting security concerns
A security analyst ensures that employees are able to review only the data they need to do their jobs. Which security domain does this scenario relate to?
Communication and network security
Software development security
Identity and access management
Security assessment and testing
Identity and access management
Which of the following statements accurately describe risk? Select all that apply.
A high-risk asset is any information protected by regulations or laws.
If compromised, a low-risk asset would have a severe negative impact on an organization’s ongoing reputation.
Another way to think of risk is the likelihood of a threat occurring.
If compromised, a medium-risk asset may cause some damage to an organization’s ongoing operations.
You didn’t select all the correct answers
Another way to think of risk is the likelihood of a threat occurring.
If compromised, a medium-risk asset may cause some damage to an organization’s ongoing operations.
