CISSP Study Notes Chapter 16 - Managing Security Operations

Chapter 16 goes over securely provisioning resources, understanding and applying foundational security operations concepts, applying resource protection techniques, implementing and supporting patch and vulnerability management, understanding and participating in change management, and addressing personnel safety and security concerns.

Last summer I spent about a month studying for and getting my Certified Information Systems Security Professional (CISSP) certification from ISC2. I went about studying for the test a few ways:

  • I used the PocketPrep app
  • I attended a study bootcamp
  • I did a bunch of practice tests

And finally…

  • I got the ISC2 CISSP official study guide - I read it cover to cover, and highlighted and annotated the entire thing.

Twitter (@MrThomasRayner) told me there is interest in seeing my study notes. So, here we go! Welcome to my 21 part series on the takeaways and crucial points from each chapter in the ISC2 CISSP official study guide. To be clear, this isn’t a replacement for all those other study methods I mentioned above. This is just a supplement. This also isn’t everything you need to know for the test. This is just what I feel are the most important points.

It’s important to remember that while many of these terms and phrases have different meanings in different contexts, the definitions I’m providing below are the ones that are relevant in the CISSP exam. Your own training or experience may tell you that a definition is incorrect or invalid, but if you want to get the exam questions right, you’ll have to know them as they’re defined in the books and study material.

The CISSP exam is often said to be “a mile wide but only an inch deep” which means you need to know a little bit about a lot of stuff. Accordingly, these posts contain a lot of points and while you might not be questioned on all of them, you could be questioned on any of them. It’s important to have a good grip on every chapter in its entirety.

Previous Chapters

Chapter 16: Managing Security Operations

My key takeaways and crucial points

Applying Security Operations Concepts

  • Due care and due diligence refers to taking reasonable care to protect the assets of an organization on an ongoing basis
  • Need to know
    • Focuses on permissions and the ability to access information
    • Rights
      • Refers to the ability to take actions
    • Grant users access only to data or resources they need to perform assigned work tasks
  • Least privilege
    • Granted only the privileges necessary to perform assigned work tasks and no more
    • Entitlement
      • The amount of privileges granted to users
    • Aggregation
      • The amount of privileges that users collect over time
    • Transitive trust
      • A trust relationship between two security domains
  • Separation of privilege
    • No single person has total control
    • Collusion
      • An agreement by two or more persons to perform some unauthorized activities
    • Helps reduce fraud
    • Builds on least privilege
    • Segregation of duties is specifically required by SOX
  • Two person control
    • Operations that require two keys
    • Ensures peer review, reduces likelihood of fraud
    • Split knowledge is where information or privilege is divided among multiple users
  • Job rotation
    • Encourages peer review, reduces fraud, enables cross training
    • Acts as both a deterrent and a detection mechanism
  • Mandatory vacations
    • Peer review, helps detect fraud and collusion
    • Acts as a deterrent and a detection mechanism

Privileged Account Management

  • Special privilege operations
    • Activities that require special access or elevated rights and permissions to perform
    • Sensitive job tasks
  • Monitoring usage of special privileges, so organizations can deter employees from misusing privileges and detect actions
  • Perform access review audits

Managing the Information Lifecycle

  • Creation/capture
    • Data is created by users, downloading files, etc.
  • Classification
    • Should be done asap
    • Ensure that sensitive data is identified and handled appropriately based on its classification
    • Once data is classified, it can be marked and handled correctly
      • Easily recognize data’s value
  • Storage
    • Periodically back up
    • Encrypted
    • Physical security
  • Usage
    • Any time data is in use or in transit over a network
    • Used in an unencrypted format
  • Archive
    • Comply with laws/regulations regarding data retention
    • Ensure data is available
  • Destruction/purging
    • NIST 800-88r1

Service Level Agreements

  • Defines performance expectations and penalties
  • Sometimes have memorandums of understanding
    • and/or an interconnection security agreement
    • Two entities work together toward a common goal
  • Can specify technical requirements

Addressing Personnel Safety and Security

  • Always possible to replace equipment and data, can’t replace people
  • Human safety is ALWAYS top priority
  • Duress
    • A simple duress system is just a panic button that sends a distress call
    • More common when working alone
    • Code words or phrases
  • Travel
    • Verify a person’s identity before opening a hotel door
    • Sensitive data is ideally not brought on the road, but if it is it needs to be encrypted
    • Malware/monitoring devices
      • Maintain physical control of all devices
      • Do not bring personal devices
    • Free WiFi
      • Vulnerable to man in the middle attacks
  • Emergency management
    • Natural or man-made disasters
    • Locate sensitive physical assets toward the center of the building

Managing Virtual Assets

  • Reduction in overall operating costs when going virtual
  • Hypervisor
    • Essential virtualization software

Managing Cloud Based Assets

  • SaaS
    • Software as a service
    • Fully functional applications accessed via web browser, usually
  • PaaS
    • Platform as a service
    • Computing platform, including hardware, an OS, and applications
  • IaaS
    • Infrastructure as a service
    • Basic computing resources
  • NIST 800-145
  • Public cloud
    • Available for any consumers
  • Private cloud
    • Single organization
  • Community cloud
    • Two or more organizations
  • Hybrid cloud
    • Combination of two or more clouds

Media Management

  • Includes any hard copy of data
  • When media is marked, handled and stored properly, it helps prevent unauthorized disclosure (loss of confidentiality), unauthorized modifications (loss of integrity), and unauthorized destruction (loss of availability)
  • Tape media
    • Keep at least two copies of backups
    • At least one offsite
  • Mobile devices
    • MDM system monitors and manages devices, ensures they are up to date
    • Encryption protects data if phone is lost or stolen
  • Managing media lifecycle
    • Once backup media has reached it’s MTTF, it should be destroyed
    • Degaussing does not remove data from an SSD

Managing Configuration

  • Baselining
    • Baselines are starting points
    • When systems are deployed in a secure state with a secure baseline, they are more likely to stay secure
  • Using images for baselining
    1. Create the image
    2. Capture the image
    3. Deploy the image
  • Ensure that desired security settings are always configured correctly

Managing Change

  • Change management
    • Reducing unanticipated outages by unauthorized changes
    • Primary goal is to ensure that changes do not cause outages
  • Unauthorized changes directly affect availability
  • Security impact analysis
    1. Request the change, identify desired changes
    2. Review the change
    3. Approve/reject the change
    4. Test the change
    5. Schedule and implement the change when it will have the least impact
    6. Document the change
  • Emergency changes can still occur, but the process still needs to document the changes
  • Versioning
    • Labeling or numbering system that differentiates between different software sets and configurations across multiple machines or at different points in time on a single machine
  • Configuration documents
    • Who is responsible
    • Purpose of the change
    • List all changes to the baseline

Managing Patches and Reducing Vulnerabilities

  • Systems to manage
    • Any computing device with an OS
    • Network infrastructure systems
    • Embedded systems
  • Patch management
    • Patch
      • Any type of code written to correct a bug or vulnerability or improve the performance of existing software
    • Evaluate patches
      • Determine if they apply to your systems
    • Test patches
      • Test on an isolated nonproduction system
      • Determine unwanted side effects
    • Approve the patches
      • Change management
    • Deploy the patches
      • Automated methods
    • Verify that patches are deployed
      • Regularly test and audit systems
  • Vulnerability management
    • Identifying vulnerabilities, evaluating them, mitigating risks
    • Vulnerability scans
      • Test systems and networks for known security issues
      • Nessus by Tenable Network Security
      • Generate reports
    • Vulnerability assessments
      • Scan reports from past year to determine if the organization is addressing vulnerabilities
      • “Why hasn’t this been mitigated?”
      • Part of a risk analysis or assessment
    • Common vulnerabilities and exposures
      • MITRE maintains the CVE database:
      • MITRE is not an acronym, funded by US government to maintain the database
Written on October 14, 2020