Evidence: How you obtain and handle evidence is VERY important. Types of evidence: Real Evidence: Tangible and Physical objects, in IT Security: Hard Disks, USB Drives – NOT the data on them. Direct Evidence: Testimony from a first hand witness, what they experienced with their 5 senses. Circumstantial Evidence: Evidence to
Legal and regulatory issues. As IT Security Professionals we need to understand that laws and regulations have a huge influence on how we work. We need to know some of them and understand how the rest work. There are 4 types of laws covered on the exam and important to
Equifax has without notifying anyone updated their breach FAQ, now saying that it was breached using a vulnerability in Apache Struts. “We know that criminals exploited a U.S. website application vulnerability. The vulnerability was Apache Struts CVE-2017-5638.” https://www.equifaxsecurity2017.com/frequently-asked-questions/ The bug was widely reported and patches have been available since March,
The US Department of Energy (DOE) has announced 20 cybersecurity projects aimed at enhancing the reliability and resilience of the American electric grid, and oil and natural gas infrastructure through “innovative, scalable and cost-effective research and development of cybersecurity solutions.” https://www.infosecurity-magazine.com/news/us-energy-department-funds-20/
For the certification it is important to know where you are in the organization and answer the questions from that viewpoint. You are a risk adviser or a IT security manager, answer all questions with that in mind. Governance vs. Management Governance – This is C-level Executives (Not you). Stakeholder
Having top-down IT security leadership in an organization is key to success. If we do not have the buy-in of senior leadership, we will do a mediocre job at best. For the CISSP certification questions assume a top-down organization. In a new survet (ISC)² Finds IT Professionals are an Underutilized