Please enable JavaScript.

Coggle requires JavaScript to display documents.

DOMAIN 1 (1.1->1.6): SECURITY AND RISK MANAGEMENT - Coggle Diagram

- - - - Canon 3: Provide diligent & competent service to principals
        
        Priority: Client-focused
        -
        
        Application: Advise best security practices, not cheapest (e.g., explain risks)
        
        CISSP Question: Client wants low-cost solution - Recommend competent alternative
        
        Canon 4: Advance & protect the profession
        
        Priority: Lowest (After others)
        
        Application: Train peers, report violations to ISC² (e.g., unethical colleague)
        
        CISSP Question: How to maintain profession's reputation? (Educate & report)
  - - - Application in CISSP Exam
        
        Scenarios: Ethical dilemmas (e.g., sharing sensitive data, ignoring vulnerabilities)
        -
        
        Key Principle: Follow policies & "do no harm"
        -
        
        Example Question 1: "Colleague asks to share sensitive data to speed up work. What to do?"
        
        Answer: Refuse & report (follow policy, protect security)
        
        Example Question 2: "Manager asks to ignore security flaw. What to do?"
        
        Answer: Report & fix flaw (follow policy, protect organization)
        -
        
        Exam Tips
        
        Prioritize actions aligned with company policies & laws
        
        Choose organization/community benefit over personal gain
        
        Senior management responsible for ethics enforcement
- - - - Example Question 3: "DDoS attack downs website. Which pillar?"
        
        Answer: Availability
        
        Reason: Asset unavailable to stakeholders
        -
        
        Example Question 4: "Fake CEO email requests money. Enhance which pillar?"
        
        Answer: Authenticity
        
        Reason: Verify source of email
        -
        
        Example Question 5: "Employee denies sending sensitive email. Solution?"
        
        Answer: Digital signature (Nonrepudiation)
        
        Reason: Prevents denial of action
        
        Exam Tips
        
        Identify affected asset & violated pillar
        -
        
        Choose controls matching pillar (e.g., encryption for Confidentiality)
        -
        
        Apply to all assets, not just data