CISSP Domain 7

1
(No Transcript)
2
7.1 UNDERSTANDING AND COMPLYING WITH
INVESTIGATIONS
Properly gather, store, and preserve evidence
while maintaining its integrity
Evidence Collection and Handling
Record investigation findings and maintain
thorough documentation
CISSP DOMAIN 7
Reporting and Documentation
Use systematic approaches to gather and analyze
evidence
Investigative Techniques
Use specialized tools and procedures to analyze
digital data
Digital Forensic Tools, Tactics, and Procedures
Identify and analyze digital artifacts (files,
logs, etc.)
Artifacts
3
7.2 CONDUCT LOGGING AND MONITORING ACTIVITIES
Intrusion Detection and Prevention (IDS/IPS)
Detect and prevent network intrusions
Security Information and Event Management (SIEM)
Centralized logging and threat detection
CISSP DOMAIN 7
Ongoing assessment of security status
Continuous Monitoring
Monitoring outbound network traffic
Egress Monitoring
Collect and store log data
Log Management
Gather and analyze threat data
Threat Intelligence
User and Entity Behavior Analytics (UEBA)
Analyze user and entity behavior patterns
4
7.3 PERFORM CONFIGURATION MANAGEMENT (CM)
Identify Configuration Items
List all configuration components
CISSP DOMAIN 7
Define standard configuration settings Control
changes to configurations
Baseline Establishment Change Management
Track and document configurations Ensure
compliance with configurations
Configuration Status Accounting Configuration
Verification and Audit
Use software for CM tasks
Automated Tool Utilization
5
7.4 APPLY FOUNDATIONAL SECURITY OPERATIONS
CONCEPTS
Access only to
Need-to-Know
information necessary for a role
Need-to-Know/Least Privilege
Minimum level of access required for job functions
Least Privilege
CISSP DOMAIN 7
Separation of Duties Divide responsibilities
among different individuals
(SoD)
Privileged Account Management
Control and monitor privileged accounts
Reduce risk and prevent collusion
Job Rotation
Define performance and security expectations
Purpose
Service Level Agreements (SLAs)
Uptime guarantees, response times, and security
measures
Components
6
7.5 APPLY RESOURCE PROTECTION
Inventory tracking Labeling and classification
Media Management
CISSP DOMAIN 7
Secure storage

• Controlled access
• Secure storage locations (e.g., locked cabinets)
• Physical Security
• Environmental controls
• (e.g., temperature, humidity)

Encryption of data on media
Media Protection
Logical Security
Techniques
Access controls (e.g., user authentication) Secure
transportation
Handling Procedures
Sanitization and destruction Regular audits and
monitoring
7
7.6 CONDUCT INCIDENT MANAGEMENT
Identify incidents via logs and alerts
Detection
Immediate actions to contain incident
Response
CISSP DOMAIN 7
Mitigation
Address root cause, prevent recurrence
Reporting
Document incident, response, lessons learned
Recovery
Restore systems and data functionality
Fix vulnerabilities causing incident
Remediation
Implement security improvements post-incident
Lessons Learned
8
7.7 OPERATE AND MAINTAIN DETECTIVE AND
PREVENTIVE MEASURES
Control traffic via security policies Types
Next-gen
Firewalls
web application Network
CISSP DOMAIN 7
Intrusion Detection/Prevention Systems (IDS/IPS)
Monitor and prevent unauthorized access
Whitelisting Allow authorized
applications/users
Whitelisting/blacklisting Blacklisting Block
malicious applications/users Third-party provided
Managed Detection and Response (MDR)
security services
Isolated environment to analyze suspicious
code/files
Sandboxing
Decoy systems to lure and capture attackers
Honeypots/honeynets
Anti-malware
Protect against malicious software
Machine learning and
Anomaly detection and threat hunting
Artificial Intelligence tools
9
7.8 IMPLEMENT AND SUPPORT PATCH AND
VULNERABILITY MANAGEMENT
Vulnerability Scanning
Detect vulnerabilities
Identify and Classify Vulnerabilities
Risk Assessment
Prioritize based on risk
CISSP DOMAIN 7
Vendor patches
Patch Identification
Patch Testing
Test before deployment
Patch Management Process
Apply patches
Patch Deployment
Patch Verification Ensure correct
application
Discovery Analysis
Monitor continuously
Vulnerability Management Process
Assess impact
Remediation
Apply fixes
Verification
Confirm resolution
Patch Management Automate deployment
Tools Vulnerability Management Tools
Tools and Technologies
Automate scanning
Configuration Maintain secure
Management
configurations
10
7.9 UNDERSTAND AND PARTICIPATE IN CHANGE
MANAGEMENT PROCESSES
Manage and control changes
Purpose of Change Management
Reduce the impact of changes
Maintain business continuity
CISSP DOMAIN 7
Submit and track change requests
Request for Change (RFC) Impact
Assessment Approval Process
Evaluate the potential effects of changes Gain
authorization for
proposed changes
Change Management Process
Execute approved changes
Implementation Testing and
Ensure the change works as intended Record all
changes for future reference
Validation
Documentation
Standard Pre-approved,
low-risk changes
Changes
Emergency Unplanned, urgent
Types of Changes
changes High-impact, complex changes
Changes Major Changes
11
7.10 IMPLEMENT RECOVERY STRATEGIES
Full, incremental, differential
Types
Backup Storage Strategies
On-site, off-site, cloud
Locations
Frequency
Regular scheduling
CISSP DOMAIN 7
Fully operational, minimal downtime Partially
equipped,
Hot Sites
Recovery Site Strategies
Warm Sites
moderate setup time
Basic infrastructure, significant setup time
Cold Sites
Primary and
Ensure business continuity
Secondary Sites Load Balancing
Multiple Processing Sites
Distribute workload across multiple sites
Geographical Reduce risk from
Separation
localized disasters
System Resilience Ability to recover
from failures High Availability Minimizing
downtime
System Resilience, HA, QoS, and Fault Tolerance
through redundancy Ensuring performance
standards
(HA) Quality of Service (QoS)
Fault Tolerance
Continuous operation despite failures
12
7.11 IMPLEMENT DISASTER RECOVERY (DR) PROCESSES
Follow DR plan to initiate recovery procedures
Response
Assign roles and responsibilities
Personnel
CISSP DOMAIN 7
Communications
Establishing clear communication channels
Assessment
Evaluate damage and scope of recovery
Restoration
Restore systems and data
Training and awareness
Train personnel on DR procedures
Review and improve DR process
Lessons learned
13
7.12 PARTICIPATE IN BUSINESS CONTINUITY (BC)
PLANNING AND EXERCISES
Continuous operations during/after a disaster
Definition
Understand Business Continuity (BC)
Importance Minimize disruption
and loss
Identify critical functions
CISSP DOMAIN 7
Conduct Business Impact Analysis (BIA)
Prioritize recovery efforts
Recovery strategies Document procedures Define
roles

Develop Business Continuity Plan (BCP)
Backup solutions Alternative sites Redundant
systems
Implement Recovery Strategies
Regular training
Conduct Training and Awareness
Awareness programs Tabletop exercises Functional
tests Full-scale drills Regular updates
Perform Testing and Exercises
Review and Update the BCP Incorporate changes
Align plans
Integrate with Incident Response Plan
Streamline processes
14
FOUND THIS USEFUL?
Get More Insights Through Our FREE
Courses
Workshops
eBooks
ChecklisEs
Mock TesEs
Like
Share
Follow