Qualitative Risk Analysis – How likely is it to happen and how bad is it if it happens? This is vague, guessing, a feeling and relatively quick to do. Most often done to know where to focus the Quantitative Risk Analysis. Qualitative Risk Analysis with the Risk Analysis Matrix. Pick
Access Control Defensive Categories and Types: Access Control Types (Many can be multiple types – On the exam look at question content to see which type it is). Preventative: Prevents action from happening – Least Privilege, Drug Tests, IPSs, Firewalls, Encryption. Detective: Controls that detect during or after an attack
Before you can take the exam you will agree to the ISC² Code of Ethics, they are also very testable on the certification. Learn them. ISC² Code of Ethics You agree to this before the exam, and the code of ethics is very testable. There are only four mandatory canons in
Defense in Depth – Also called Layered Defense or Onion Defense. We implement multiple overlapping security controls to protect an asset. This applies both to physical and logical controls. To get to a server you may have to go through multiple locked doors, security guards, man traps. To get to
Liability: If the question is who is ULTIMATELY liable, the answer is Senior Leadership. This does not mean you are not liable; you may be, that depends on Due Care. Who is held accountable, who is to blame, who should pay? Due Diligence and Due Care: Due Diligence – The
Least Privilege and Need to know. Least Privilege – (Minimum Necessary Access) Give users/systems exactly the access they need, no more, no less. Need to know – Even if you have access, if you do not need to know, then you should not access the data. Non-repudiation. A user can