Please enable JavaScript.

Coggle requires JavaScript to display documents.

Domain 1: Security and Risk Management, Continuity Planning Focuses on…

- - - - COBIT (Most widely used)
        Prescribes goals and requirements for security controls
        
        OSSTMM (Open Source Security Testing Methodology Manual)
        Guide for testing and analysis of security infrastructure
        
        ISO/IEC 27002
        Basis of implementin organisational security and related management practices
        
        ITIL (Information Technology Infrastructure Library)
        Set of recommended best practices for core IT security and operational processes. Good starting point for crafting a customised IT Seccurity Solution
  - - - Sanitisation to prevent data leakage
        
        Storage media removed/destroyed
        
        Exit interview: Debrief retrenched employees, review NDAs, contracts, agreements that will continue after employment has ceased.
    - - Security oversight and increased scrutiny essential to reduce risk associated with transformation.
        
        Information Disclosure
        
        Data Loss
        
        Downtime
        Failure to achieve sufficient ROI
    - - Change Control Management:
        
        Primary purpose: Make all changes subject to detailed documentation and auditing, to be reviewed/scrutinised by management.
        
        Goal is to ensure any change does not lead to reduced or compromised security.
        
        Changes reviewed and approved by Change Advisory Board (CAB)
        
        Manage change by extensive planning, testing, logging, auditing, and monitoring of activities related to security control mechanisms.
        
        Makes it possible to roll back changes to a previous secured state.
        
        Implemented on any system, despite level of security.
        
        To be incuded throughout SDLC:
        
        Design
        
        Development
        
        Testing
        Evaluation
        
        Implementation
        Distribution
        
        Evolution
        
        Growth
        
        Operations
        
        Modification
        
        Requires:
        
        Detailed inventory of every component and configuration
        
        Colleciton of maintenance of complete documentation for every system component (hardware, software, configs, security features)
      - Data Classification
        
        Primary objective: Formalise and stratify the process of security data based on assigned labels of importance and sensitivity.
        
        To determine how much effort, money and resources are allocated.
        Can be classified based on value, cost, sensitivity, risk, vulnerability, power, privilege, potential levels of loss or damage, or need to know.
        
        Data Classification Seven Major Steps:
        
        Identify custodian, define their responsibilities
        
        Specify evaluation criteria of how information will be classified/laveled
        
        Classify and label each resource (Done by Owner, reviewed by Supervisor)
        
        Document exceptions to classification policy
        
        Select Security Controls to be applied at each classification level
        
        Specify procedures to declassify resources, and procedures for transferring custody of resource to external entity
        
        Create enterprise awareness program to instruct personnel on classification system
        
        Governement/Military Classification:
        
        Top Secret - Grave damage
        
        Secret - Critical damage
        
        Confidential - Serious damage
        
        Sensitive but unclassified (For Office Use Only/Controlled Disclosure). Used to protect data that could violate privacy rights of individuals. Not technically classification label.
        
        Unclassified. Not technically classigification label.
        
        Classified = Confidential, Secret, Top Secret.
        
        Commercia/Business Classification Levels:
        HIGH
        
        Confidential (or Proprietary)/Private
        MEDIUM
        
        Sensitive
        LOW
        
        Public
        
        Data Ownership:
        The formal agreement/responsibility to individual or group.
  - - - Operational Security is the ongoing maintenance of continued due care and due diligence by all responsible parties in an organisation.
      - Proving due care and due diligence reduces culpability and liability when a loss occurs.
  - - - Includes designing and implementing security based on business case, budget restrictions, or scarcity of resources.
        
        Elements of Security Management Planning:
        
        Define security roles
        
        Prescribe how security will be managed, who is responsible for security, and how security will be tested for effectiveness
        
        Develop Security Policies
        
        Perform Risk Analysis
        
        Requiring Security Education for Employees
        
        Three types of plans (as developed by Security Management Planning Team):
        
        Tactical Plan
        Provides details on accomplishing goals in strategic plan. 1 Year.
        
        Budget Plans
        
        Maintenance Plans
        
        Hiring Plans
        
        Support Plans
        
        System Development Plans
        
        Project Plans
        
        Acquisition Plans
        
        Operational Plan
        Highly detailed plan based on Strategic and Tactical plans. Updated often (monthly or quarterly) to retain compliance with Tactical plans..Short term.
        
        Product Design Plans
        
        System Deployment Plans
        
        Training Plans
        
        Strategic Plan
        Defines organisation's security purpose. Long term, sustainable. 5 Years. Includes Risk Assessment
      - Top-Down approach is most effective Security Management Planning method.
        
        Upper management initiates and defines Security Policies. This shows Due Care and Due Diligence. Managers held liable for asset & financial losses.
        
        Middle management flesh out policies into standards, baselines, guidelines, procedures.
        
        Operational managers/security professionals implement.
        
        End-users comply with all security policies.
        
        Security Plans must have Senior/Upper Management Approvals
      - CISO/CSO should report directly to upper management. InfoSec team reports to CISO/CSO
- - - - Termination:
        
        Should take place with at least one witness, preferrably higher-level manager and/or security guard.
        
        Once enformed of release, they should be escorted off premises.
        
        Before release, all access cards, badges, keys, tokens should be collected.
        
        Ideally, system access should be removed at same time or right before termination.
        
        Where possible, exit interview should occur to review the liabilities and restrictions placed on former employee based on Employee Agreement.
        
        Best time to terminate employee is end of their shift midweek. Midweek allows employee to start looking for new employment before weekend. End of shit alows it to occur with little disruption.
        
        Termination must be implemented in this order:
        
        Inform person they are relieved of job
        
        Request return of all access cards, badges, keys, and company equipment
        
        Disable person's electronic access to all aspects of organisation
        
        Remind person about NDA obligations
        
        Escort them off premises