1. Security and Risk P2

1. Security and Risk P2

1. Lesson 1.10 - Implementing Third Party Security

   • Oversight and Due Diligence
   • Non-disclosure Agreements
   • Contract Provisions including Regulatory requirements and Incident Notification
   • CISSP Exam Tips
     • Companies can outsource work but not liability
     • Transparency should be required for incidents that occur at a third-party
     • SLA's set performance benchmarks

2. Lesson 1.11 - Understanding and Applying Threat Modeling

   • CISSP Exam Tips
     • Threat Intelligence is evidence-based knowledge
     • An ISAC is a trusted sector-specific entity
     • An exploit is when a threat agent successfully takes advantage of a vulnerability

3. 1.12 Understanding & Implementing Risk Management Concepts

   • Risk
   • Risk Management Framework
   • Risk Management Program components
   • Risk Acceptance
   • Risk Mitigation including: Reduction, Sharing, Transfer and Avoidance
   • CISSP Exam Tips
     • Risk Tolerance is the level of risk or degree of uncertainty that is acceptable to an organization
     • Risk Mitigation options are to Reduce, Share, Transfer or Avoid
     • Risk tolerance exceptions should always be brought to the attention of management

4. 1.13 Exploring Risk Assessment Methodologies

   • CISSP Exam Tips
     • The objective of Risk Assessment is to identify the level of risk
     • Hybrid Risk Assessments incorporate qualitative and quantitative methodologies
     • The ISO/IEC 27005 standard provides guidelines for information security risk management
   • Risk Assessment Termilonogy
   • Risk Assesment approaches
     • Qualitative
     • Quantitative
     • Hybrid
   • Risk Assessment Methodologies
     • NIST
     • FRAP
     • OCTAVE
     • ISO/IEC 27005

5. 1.14 Conducting a Quantitative Risk Assessment

   • Asset Value (AV) $
   • Exposure Factor (EF) %
   • Single loss expectancy (SLE) $
   • Annualized rate of occurrence (ARO) Fraction or integer value
   • Annual loss expectancy (ALE) $
   • Cost Benefit Calculation
   • CISSP Exam Tips
     • SLE = AV (asset value in $) x EF (exposure factor in %)
     • ALE = SLE (Single loss expectancy) x ARO (Annualized rate of occurrence)
     • The cost of risk mitigation should not be greater than the risk it is mitigating

6. 1.15 Conducting a Qualitative Risk Assessment

   • CISSP Exam Tips
     • Qualitative Risk Assessments are scenario based
     • Qualitative Risk Assessments use descriptive terminology such as high, medium and low
     • OCTAVE and NIST SP 800-30 are quantitative methodologies

7. 1.16 Selecting Controls and Countermeasures

   • Controls/Safeguards/Countermeasures
   • Layered Security = Defense in Depth
   • Control Categories and Functionality
   • Controls Guidance
   • Auditing Security Controls
   • CISSP Exam Tips
     • Controls are typically applied in multiple layers resulting in defense-in-depth
     • COBIT is a set of control objectives that can also be used for auditing
     • Effectiveness (Assurance) is how well a control works

8. 1.17 Managing Supply Chain Risk

   • Supply chain participants
   • Supply chain risks and risk management
   • Supply chain due diligence and assurance
   • SSAE16 reports
   • SysTrust and WebTrust principles and certification
   • CISSP Exam Tips
     • Assurance mechanisms include due diligence, inspection assessment, and audit reports
     • Embed supply chain requirements in contracts and service level agreements
     • The most common technology and security related independent controls audit report is SSAE 16

9. 1.18 Implementing Business Continuity Risk Management

   • Business Continuity Planning
   • Business Continuity Project Phases
   • Business Impact Analysis (BIA)
   • BIA Metrics
   • CISSP Exam Tips
     • Business Continuity is a component of risk management
     • Business Continuity should be viewed as an iterative project
     • BC requirements may be influenced by contractual or regulatory requirements