CISSP_Notes.txt

Always assume Discretionary Access Control (DAC)

Always assume a large company (100+)

Don’t get wrapped up in US Law (in many countries, in some countries = ignore US law)

Example: Reasonable expectation of privacy while using business systems. In US, there is usually no expectation of privacy. In EU, there is an expectation of privacy by law.

If they don’t tell you budget is a concern, assume budget is not concern and go with the Cadillac answer

Don’t forget about Physical Security (a lot of times a lock and key could be the best answer), Don't forget about availability

Take breaks! If you don’t know what a question is asking, try taking a break.

When the test asks about 'senior management': Unless told otherwise, assume they mean CEO, CFO, and board of directors.

When we talk about accounting, we're talking about writing log entries and holding people accountable.

When talking about auditing, we're talking about reading those log entries.

When trying to decide between different answers, 1 answer will appeal to sys admin, 1 will appeal to manager. Pick the manager.

i.e. if you have multiple answers and 1 says 'do what policy says' that’s going to be the answer.

If you come across a question and you think it's an easy win, read it again. It's probably a trick.

Be aware of "Answer Bias"

If you read a multiple choice question, you have a bias towards A or B and bias against C or D.

Overcome by reading answers first, and questions second.







General Axioms:

Number 1 goal is to protect life

Building is on fire, they want you to run into building to get backup tapes.

Always assume getting people out of the building is first priority even when stated otherwise.

Everyone is responsible for security

Janitor with no login is responsible too. After he sweeps server room, he must lock the door behind him.

Senior Management is ultimately Responsbile for security

CISO is accountable, but senior management is responsible.

Senior management writes the security policy, CISO uses that to do their job.

If there is a breach CISO is fired, senior management puts another CISO in place.

Never spend more for a control than what you are protecting. (Single loss expectancy  * Annual rate of occurance)

$500 car that you pay $1500 a year on to protect. Not a good investment.

We don’t accept risk, only senior management can accept risk. We advise on what risks to accept.

Can't transfer ultimate responsibility, just some of the fallout i.e. financial responsibility

If you're reading a network question and it covers layer 1-4, recheck the model.

Training and awareness are mandatory. This includes cross-training.

Cross-training

Staffing for resilience

Paper is a media.

Consider paper the same way you would a hard drive.

Patterns are bad (Cryptography)

Senior Management can do whatever they want.

Our job is to make sure when they make the decision, they have a basic understanding of the risks. As long as they do, they can make whatever decision they want.

IT Security supports the business, not vice versa.

If it wasn't this way, we'd just get rid of half the things they do.

An attack on availability could be just slowing down the system, rather than knocking it out.

Making a system run at degraded speed is a successful attack

Digital signatures don't do shit for confidentiality. Only integrity and non-repudiation.

No single control can be considered perfect.

Does this mean you need multiple or that you should assume each one is inherently flawed?

eCommerce = Encryption.

If they mention eCommerce, they want you to be aware of you handling credit cards.

PCI

Requirement 4 = protect data in transit

Best way to protect data in transit? Encryption.

No way to inspect an encrypted payload



Users = Subjects

Subject

Anything that wants to get to an object.



Before a subject can get to an object, it should have a 'referee' i.e. something that grants or denies access.

Security kernel

Contains rules that allow the referee to make decisions.

Audit file

Keeps a protected log of all subjects, what objects they accessed and preferably reasoning from the kernel





Is this a reference monitor?

Can it block a subject from getting to an object?

Yes: It is a reference monitor

No: it is not a reference monitor.



Complete Mediation

Even if you've been through the reference monitor a million times and were granted access a million times. You should not circumvent the reference monitor as at a minimum, you want an audit file which the reference monitor will generate.


Covert Channel

Anything that circumvents a reference monitor.

Confidentiality

Keeping secrets secret.

Enemy of Confidentiality is Disclosure

How do you protect confidentiality?

Encryption

Logical Access control

Physical Access Control



Integrity

Can you trust the data?

Has the data been changed?

Was it correct when it was collected?

Enemy of Integrity is Alteration

How do you provide Integrity

Hashing

Goals of integrity:

Stop unauthorized changes from unauthorized subject

Threat agents

Stop unauthorized changes from authorized subject

Mistakes and errors

Maintain data consistency



Availability

Data is available to authorized users when they need it.

Enemy of availability is Destruction or downtime





D.A.D.D.

Enemies of CIA

Disclosure
Alteration
Destruction/Downtime



Risk Appetite

How much risk is senior management comfortable taking on in the organization?





CISO

Manage security infrastructure

Metrics - If you can't measure it, you can't improve it.

Advise Senior management on security risks



Metrics

Comes from 2 places

Measurement Variation

Don’t change the way you're measuring. Stay consistent to see trends over time.

Process variation

The actual variation that is happening in the process





Policy

Brief, high-level statement

"Policy should never be longer than 2 pages"

Don't leave policy up for interpretation.

e.g. "We will be HIPAA compliant."



Standards

"Bulleted list"



Procedures

"Numbered list"



Baselines

Minimum security configuration for different systems.

Senior management is responsible for establishing baselines.

Baseline info may be collected from vendors, open standards, etc.



Scoping

Go through everything a baseline talks about, decide what works and what doesn’t.

Armed guards are too much for us, but security cameras is a good fit.

Tailoring

Make the baseline specific to your business.

16 cameras, 8 inside, 8 outside.





Guidelines

Generalized ideas on how management would expect something to be completed that may not have a set of standards/procedures/baselines in existence





Governance leads into Compliance leads into Assurance



Due Dilligence

Making the rules

What would any reasonably prudent person do? "Prudent person rule"

An individual should make every effort to complete his or her responsibilities in an accurate and timely manner

Due Care

Everyone following the rules


Superficial Security Frameworks:



ITIL - Information Technology Infrastructure Library

Continual Service Improvement



COSO - Committee of sponsoring organizations

All about financial Fraud



COBIT - Control objectives for Information and related Technologies

Developed by ISACA

Auditors use this to define what controls you should have









Real Security Frameworks



ISO 27000

ISO/IEC 27000

General Overview



Information security management systems

Overview and vocabulary



ISO/IEC 27001

Actual standard, includes ISMS and Requirements



Information technology - Security Techniques - Information security management systems

Requirements. The 2013 release of the standard specifies an information security management system in the same formalized, structured and succinct manner as other ISO standards specify other kinds of management systems.



ISO/IEC 27002

Listing of example controls that could be used to meet 27001 requirements



Code of practice for information security controls

essentially a detailed catalog of information security controls that might be managed through the ISMS



ISO/IEC 27003

Information security management system implementation guidance



ISO/IEC 27004

Guidelines for metrics

Information security management

Monitoring, measurement, analysis and evaluation



ISO/IEC 27005

Information security risk management

(NIST SP800-39)



ISO/IEC 27006

Requirements for bodies providing audit and certification of information security management systems



ISO 22301

Information technology -- Security techniques -- Guidelines for information and communication technology readiness for business continuity



NIST SP-800

US Specific

Not as heavily placed into the CISSP test any more as the test is meant to be 'international'







Compliance Frameworks



PCI-DSS

Actual Standard: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf

Review requirements 1-12 and Appendix A



Only applies to organizations that do business directly with members of the PCI council. (i.e. VISA, MasterCard, Discover, etc.)



PCI is not a law, it is a contract.



PAN - Primary Account Number

Credit Card Number, Expiration Date, CVV



Tokenization

Replace confidential information with placeholders for identification ("tokens")

e.g. replace the credit card number of "0000-0000-0000-000" with "Token-CreditCard-1"



QSA - Qualified Security Assessor

PCI Auditors




Business Impact Analysis: BIA
========================

Gather Info

What all things do you do?

Identify what's critical

Map relationships between critical items and dependencies

"Doing the math"

Calculate "MTD" Maximum Tolerable Downtime

Calculate "RTO" - recovery time objective

Amount of time required to recover

Can be split into 2 parts.

Part 1 - RTO "amount of time to order a part"

Part 2 -  'WRT' Work Recovery Time "amount of time to install the ordered parts

Calculate "RPO" - Recovery Point objective

If a problem is encountered, how much date/time are you able to lose? i.e. If you backups are every 24 hours, your RPO should say you're willing to lose up to 24 hours of data if you were to restore to the last backup.

Perform Cost/Benefit analysis

Develop continuity plans

Perform cost/benefit analysis




usiness Continuity - Disaster Recovery - Incident Response



Means different things in practice, for this week and this week, consider these as completely separate islands.





Business continuity.

Critical Business functions, plans to get them back online fast enough.



Disaster recovery

When an incident is SO BAD that you had to 'move'



Incident Response





What's considered critical?

Whatever senior management says is critical

Whatever keeps the cash register ringing



What's considered not critical

Anything that doesn’t stop the cash register from ringing.





Business  Continuity Plan

Perform "BIA" - business impact assessment

No discussion of probability. Only impact

BIA Plans -> pick an output

Put plans into place




Risk Assessments

3 main steps

Identification

Risk analysis

Risk assessment

Qualitative Assessment

Measurement of impact and likelihood.

Low -> Medium -> High






Quantitative Risk Assessment

Annualized Loss Expectency (ALE) = Annual Rate of Occurance (ARO) * Single Loss Expectancy (SLE)

Single Loss Expectancy (SLE) = Asset Value (AV) * Exposure Factor (EF)



ALE = ARO * (AV*EF)





Terms:

Annualized Rate of Occurance (ARO)

How many times per year a risk is expected to be realized.

Single Loss Expectancy

Amount of money expected to be lost when a risk is realized.

Asset Value

In real life to determine value of an asset, hire a consultant

"Test will likely give you the asset value"

Exposure Factor

Percentage of the asset's value that would be compromised if a risk is realized





Example:

Building burns to the ground.



ARO = .01 (likely to happen once every 100 years)

AV = 200,000 (building, all items inside, land the building sits on)

EF = 75% (only 75% because 25% of the asset's value is land, which would not be affected by the building burning down)



SLE = 200,000 * 0.75 = 150,000

ALE = .01 * 150,000 = $1,500





If insurance guy comes back saying fire insurance is $1000/year

In scenario you are paying $1000 to save $1500.

ROI = (Amount your saving - cost of control)/cost of control

ROI = (1500-1000)/1000

ROI = 50%


Risk Treatments



Acceptance

Accept the risk as a cost of doing business without necessarily doing anything



Avoidance

Don't do the ting that causes risk

look for alternatives to achieve same goal



Transference

Pay someone else to be liable for the financial impact

Ultimate responsibility stays with senior management



Mitigation

Invest in solutions to address the risk and hopefully prevent it.

Address probability or impact

Safeguards

Reduces probability

Countermeasures

Reduces impact



Risk Rejection

Stick your head in the sand

If you don’t know that you've been breached, due care is not required.




 Control Types "3 slice pie" :

Administrative
Policy/Rules


Technical/Logical
Software


Physical
If you can touch it



Control Categories"7 slice pie"



----- pre-incident ------



Directive

Policies on work computer, supervisor instruction

Safeguard



Deterrent

Discourages you from trying

Safeguard



Preventative

Stops you even if you try

Safeguard



------ post incident -------



Detective

Can alert you if an incident occurs

Countermeasure



Corrective

First containment and/or eradication

Stops the bleeding

Countermeasure



Recovery

Resumes normal operation

Countermeasure



Compensating

Put in place in the absence of another control