1. Security and Risk P1

1. Security and Risk P1

1. 1.9 Implementing Personnel Security

   • Employee lifecycle including recruitment, screening and privacy expectations
   • Confidenciality and Acceptable Use Policy (AUP) agreements
   • Training and awareness programs
   • SETA model. NIST 800-16 model
   • CISSP EXAM TIPS
     • Employee agreements are legally binding contracts.
     • Organizations have an obligation to set employee privacy expectations
     • SETA is a security training model

2. 1.8 Understanding Regulatory and Contractual Requirements—Part 2

   • Sector specific privacy and security regulations
   • Groundbreaking state laws
   • Presidential directives
   • PCI DSS
   • Downstream liability
   • CISSP EXAM TIPS
     • Think global / Act Local
       • Compliance with local laws and regulations is not optional
     • PCI compliance is a contractual obligation
     • Forty-seven states plus DC have breach notification laws

3. 1.7 Understanding Regulatory and Contractual Requirements—Part 1

   • Privacy
   • Privacy concerns including data warehousing, mining, aggregation and inference
   • Global privacy laws and regulations
   • Trans-border data flow
   • CISSP EXAM TIPS
     • Security and privacy have different but complementary goals
     • The Safe Harbor Act was intended to bridge the different privacy approaches of the US and EU
     • Organizations must always follow the laws and regulations of the countries they operate in.

4. 1.6 Understanding Legal Systems and Related Laws—Part 2

   • (IP) Intellectual Property law including patents, copyrights, trademarks, trade secrets and software licensing.
     • Patents - Something that can be produced
     • Copyrights for expression of an idea
     • Trademarks to protect markings that identify an organization or service
     • Trade Secrets - secrets that are important to the organization
     • Software Licensing to express the terms and conditions of use of the SW
   • Software piracy
   • Computer crime and federal laws
   • Cybercrime
   • CISSP EXAM TIPS
     • IP laws generally require action on the part of the IP owner to obtain protection
     • Computer crime is when a computer is used in the act of committing a crime
     • Cybercrime is a criminal activity that involves the Internet, a computer system, a computer network or technology

5. 1.5 Understanding Legal Systems and Related Laws—Part 1

   • Common law, including criminal, civil and administrative
     • Based on precedent
   • Customary law including religious law
   • Convergence of legal systems
     • Hybrid law system
   • CISSP EXAM TIPS
     • Only government can prosecute a criminal case
     • Religious laws are a form of customary law
     • Administrative violations can result in monetary penalties, regualtory action, or imprisonment

6. 1.4 Designing and Implementing Governance Documents

   • Governance Documents
   • Policy lifecycle, attributes, and related responsibilities
   • The role of standards, baselines, guidelines, procedures and programs
     • Standards are Mandatory
     • Baselines are Mandatory. And are a collection of standards
     • Guidelines are guidance to help us implement a mandatory standard
     • CISSP EXAM TIPS
       • Policies require executive authorization
       • Policies, Standards and Baselines are mandatory. Guidelines are optional
       • Procedures should always be targeted to your audience

7. 1.3 Applying Security Governance Concepts—Part 2

   • Information security ecosystem
   • Executive, information security management, organizational and functional roles and responsibilities
   • CISSP EXAM TIPS
     • Information security is a distributed responsibility
     • ISM personnel should have reporting independence
     • Directors have a fiduciary oversight responsibility

8. 1.2 Applying Security Governance Concepts—Part 1

   • Governance principles
   • Due care - Due Diligence
   • 8 Generally Accepted System Security Principles - NIST SP 800-14
   • Importance of strategic alignment
   • Influence of corpotate culture
   • CISSP EXAM TIPS
     • Governance is the foundation of an information secuirty program
     • An information security program must be strategically aligned with business obhectives
     • Information security is not an IT function

9. 1.1 Examining Information Security Fundamentals

   • Cybersecurity and information security
   • CIA Security Triad - Confidentiality, Integrity, Availability
   • Five A's - Accounting, Authentication, Authorization, Accountability and Assurance
   • CISSP EXAM TIPS
     • The priority of CIA objectives is based upon organizational objectives
     • Security should be an enabler, not a disruptive force
     • Assurance is an on-going process