Please enable JavaScript.
Coggle requires JavaScript to display documents.
Domain 1 - Security and Risk Management (Legal and Regulatory Issues…
Domain 1 -
Security and Risk Management
Cornerstone Information Security Concepts
CIA Triade
Integrity - Alteration
Availability - Destruction
Confidentiality - Disclosure
AAA
Authentication
(+Identification)
Authorization
Accountability
Non-Repudiation
(combines Authentication and Integrity)
Least Privilege
Need to Know
Subjects and Objects
Defense-in-Depth
(Layer Defense)
Due Care
(what does a reasonable man)
Gross Negligence
(opposite)
Due Diligence
(management of due care)
Legal and Regulatory Issues
Mayor Legal Systems
Civil Law
(based on laws)
Common Law
(based on particular cases
and judicial precedents)
Criminal Law
victim is society
goal: punishement
Civil Law
victim is individual/organization
goal: compensating victim
statutory
compensatory
punitive
Administrative Law
Religious Law
Customary Law
(Gewohnheitsrecht, Best practice)
Criminal, Civil and Administrative Law
Liability
Prudent Man Rule
Due Care
Due Diligence
Legal Aspects of Investigations
Evidence
Real Evidence = tangible/physical objects
Direct Evidence = Testimony provided by a witness
Circumstantial Evidence = support claim, indirect proof (e.g. malware script on system)
Corroborative Evidence
Hearsay Evidence = indirect information, e.g. printout from system
Secondary Evidence = copies of original documents
Best Evidence Rule
Evidence Integrity through hashing
Chain of Custody = documentation of evidence lifecycle
Entrapment = law enforcement persuades to commit a crime
Enticement = like entrapment, but individual would have commited crime anyway
Computer Crime
computer as target
computer as tool
Intellectual Property
Privacy
International Cooperation
Import/Export Restrictions
Trans-Border Data Flow
Important Laws and Regulations
Security and 3rd Parties
Service Provider Contractual Security
Procurement
Vendor Governance
Acquisitions
Divestitures
Risk Analysis
Assets
Threats and Vulnerabilities
Risk = Threat x Vulnerability
Impact
Risk Analysis Matrix
Calculating Annualized Loss Expectancy
TCO
(Total Cost of Ownership)
ROI
(Return on Investment)
Budget and Metrics
Risk Choices
Quantative and Qualitative Risk Analysis
Risk Mgmt Process
Type of Hackers
Hackers
Black Hats
White Hats
Script Kiddies
Outsiders
Insiders
Hacktivist
Bots and Botnets
Phishers and Spear Phishers
Ethics
The (ISC)2 Code of Ethics
Computer Ethics Institute
IAB's Ethics and the Internet
Information Security Governance
Security Policy and Related Documents
Personnel Security
Access Control Defensive Categories and Types
Preventive
Detective
Corrective
Recovery
Deterrent
Compensating
Comparing Access Controls