Thor's Study Guide - C.C Domain 1

Additional context

This document outlines the fundamental pillars of organizational security, positioning itself as the bedrock for modern digital defense frameworks like those standardized by I.S.C.2. By distinguishing between broad information security, infrastructure-focused I.T security, and internet-facing cybersecurity, the text aligns with established industry taxonomies used by organizations to categorize their risk exposure. This work builds upon historical security methodologies, such as the C.I.A Triad, which has been the gold standard for evaluating risk since the late 1970s. These core principles are essential for any professional navigating today's complex regulatory landscapes, where protecting data privacy is not just a technical requirement but a legal necessity under frameworks like G.D.P.R or C.C.P.A. Furthermore, the inclusion of ethics within this foundational scope mirrors the professionalization of the cybersecurity industry, emphasizing that technical skill must be balanced with moral responsibility. By addressing governance and risk management alongside technical controls, this study guide situates itself within a holistic tradition that views security as a continuous business process rather than a static set of tools. This holistic approach is crucial for professionals because the threats organizations face are constantly evolving, requiring a strategic mindset that goes beyond simple firewall configurations. As interconnected systems continue to grow, the concepts introduced here serve as a universal language for practitioners seeking to maintain trust and operational integrity in a digital-first economy.

Introduction to Domain 1

Domain 1: What we will be covering.

- This chapter is very important because:

- Every other knowledge domain builds on top of this chapter.

- This is the foundation.

We will cover:

- The differences between Information security, I.T Security, and Cybersecurity.

- The C.I.A triad and I.A.A.A.

- Privacy.

- Risk and incident management.

- Access control.

- Governance, management, laws, and regulations.

- The I.S.C.2 ethics.

Information Security, I.T Security, and Cybersecurity

• Information Security is all our information:

- Paper documents, voice information, data, the knowledge people have, ... I.T Security is all our hard/software, and data:

- Computers, servers, networks, hardware, software, firmware, and data being processed, stored, and communicated.

- Cybersecurity is everything from I.T Security that is accessible from the internet.

The C.I.A Triad: Confidentiality, Integrity and Availability

This Is the Foundation of I.T/IS Security.

Confidentiality

- This is what most people think I.T Security is.

- We keep our data and secrets secret.

- We ensure no one unauthorized can access the data.

Integrity

- How we protect against modifications of the data and the systems.

- We ensure the data has not been altered.

Availability

- We ensure authorized people can access the data they need when they need to.

Image summary: A diagram of the CIA triad, depicted as a triangle with the labels Confidentiality, Availability, and Integrity along its three sides. An orange hexagon is inscribed within the triangle, connecting the three corners and the midpoints of the sides. The figure illustrates the three core pillars of information security and their interconnected relationship.

- Confidentiality, Integrity, and Availability.

We use:

- Encryption for data at rest (for instance A.E.S.256), full disk encryption.

- Secure transport encryption protocols for data in motion. (S.S.L, T.L.S or I.P.S.E.C).

- Best practices for data in use - clean desk, no shoulder surfing, screen view angle protector, P.C locking (automatic and when leaving).

- Strong passwords, multi-factor authentication, masking, access control, need-to-know, least privilege.

Threats:

- Attacks on your encryption (cryptanalysis).

- Social engineering.

- Key loggers (software/hardware), cameras, steganography.

- I.O.T (Internet of Things) – The growing number of connected devices we have pose a new threat, they can be a backdoor to other systems.

Confidentiality, Integrity, and Availability.

We use:

- Cryptography (again).

- Check sums (This could be C.R.C).

- Message Digests also known as a hash (This could be M.D.5, S.H.A.1 or S.H.A.2).

- Digital Signatures – non-repudiation.

- Access control.

Threats:

- Alterations of our data.

- Code injections.

Confidentiality, Integrity, and Availability

We use:

• Attacks on your encryption (cryptanalysis).

I.P.S/I.D.S.

Patch Management.

• Redundancy on hardware power (Multiple power supplies/U.P.S's/generators), Disks (R.A.I.D), Traffic paths (Network design), hvak, staff, H.A (high availability) and much more.

S.L.A's – How much uptime do we want (99.9%?) – (R.O.I)

Threats:

- Malicious attacks (D.D.O.S, physical, system compromise, staff).

- Application failures (errors in the code).

- Component failure (Hardware).

• Disclosure, Alteration, and Destruction

- The opposite of the C.I.A Triad is Dad.

- Disclosure – Someone not authorized getting access to your information.

- Alteration – Your data has been changed.

- Destruction – Your data or systems have been destroyed or rendered inaccessible.

I.A.A.A (Identification and Authentication, Authorization and Accountability)

• Identification

Image summary: A diagram of a triangle representing the CIA triad of information security. The outer edges are labeled Confidentiality, Availability, and Integrity, while the interior contains the corresponding threats: Disclosure, Destruction, and Alteration. The diagram illustrates that each core security principle is countered by a specific type of security breach.

Integrity

- Your name, username, I.D number, employee number, S.S.N etcetera

- “I am Thor”.

• Authentication

- “Prove you are Thor”. – Should always be done with multi-factor authentication!

- Something you know - Type 1 Authentication (passwords, pass phrase, pin, etcetera).

- Something you have - Type 2 Authentication (I.D, passport, smart card, token, cookie on P.C, etcetera).

- Something you are - Type 3 Authentication (and Biometrics) (Fingerprint, iris scan, facial geometry, etcetera).

Something you know - Type 1 Authentication:

Passwords, pass phrase, pin etcetera, also called Knowledge factors.

The subject uses these to authenticate their identity, if they know the secret, they must be who they say they are.

This is the most commonly used form of authentication, and a password is the most common knowledge factor.

The user is required to prove knowledge of a secret in order to authenticate.

Variations include both longer ones formed from multiple words (a passphrase) and the shorter purely numeric P.I.N's (personal identification number) commonly used for cash machines (A.T.M's).

It is the weakest form of authentication and can easily be compromised.

• Secret questions like "Where were you born?" are poor examples of a knowledge factor, it is known by a lot of people and can often be researched easily.

Sarah Palin had her email account hacked during the 2008 U.S Presidential campaign using her secret questions. Since she used basic ones (high school and birthday, ...) the hackers could

- easily find that information online, he reset her password with the information and gained full control of her email account.

Passwords:

- It is always easier to guess or steal passwords than it is to break the encryption.

- We have password policies to ensure they are as secure as possible.

- to They should contain minimum length, upper/lower case letters, numbers, and symbols, they should not contain full words or other easy to guess phrases.

- to They have an expiration date, password reuse policy and minimum use before users can change it again.

- Common and less secure passwords often contain:

- The name of a pet, child, family member, significant other, anniversary dates, birthdays, birthplace, favorite holiday, something related to a favorite sports team, or the word "password".

- Winter 2023 is not a good password, even if it does fulfil the password requirements.

- Key Stretching – Adding 1 to 2 seconds to password verification.

- If an attacker is brute forcing a password and needs millions of tries it will become an unfeasible attack.

- Brute Force Attacks (Limit number of wrong logins):

- Uses the entire key space (every possible key), with enough time any ciphertext can be decrypted.

- Effective against all key based ciphers except the one-time pad, it would eventually decrypt it, but it would also generate so many false positives the data would be useless.

- Clipping Levels: Clipping levels are in place to prevent administrative overhead.

- It prevents password guessing by locking the user account for a certain timeframe (an hour), or until unlocked by an administrator.

Password Management:

- to It allows authorized users who forget or mistype their password to still have a couple of extra tries.

- We covered some password requirements, here are the official recommendations by the U.S. Department of Defense and Microsoft.

- Password history equals set to remember 24 passwords.

- Maximum password age equals 90 days.

- to Minimum password age = 2 days (to prevent users from cycling through 24 passwords to return to their favorite password again).

- to Minimum password length equals 14 characters.

- Passwords must meet complexity requirements = true.

- Store password using reversible encryption equals false.

Something you have - Type 2 Authentication:

- I.D, passport, smart card, token, cookie on P.C, these are called Possession factors.

- The subject uses these to authenticate their identity, if they have the item, they must be who they say they are.

- Simple forms can be credit cards, you have the card, and you know the pin, that is multifactor authentication.

- Most also assume a shared trust, you have your passport, it looks like you on the picture, we trust the issuer, so we assume the passport is real.

Single-Use Passwords:

- Having passwords which are only valid once makes many potential attacks ineffective, just like one-time pads.

- While they are passwords, it is something you have in your possession, not something you know.

- Some are one-time-pads with a challenge-response or just a pin or phase sent to your phone or email you need to enter to confirm the transaction or the login.

- Most users find single use passwords extremely inconvenient.

- They are widely implemented in online banking, where they are known as T.A.N's (Transaction Authentication Numbers).

- Most private users only do a few transactions each week, the single-use passwords has not led to customers refusing to use it.

- It is their money; they actually care about keeping those safe.

- Smart Cards and Tokens (contact or contactless):

- They contain a computer circuit using an I.C.C (Integrated Circuit Chip).

- Contact Cards - Inserted into a machine to be read.

- to This can be credit cards you insert into the chip reader or the D.O.D C.A.C (Common Access Card).

- Contactless Cards - can be read by proximity.

- to Key fobs or credit cards where you just hold it close to a reader.

- to They use a R.F.I.D (Radio Frequency Identification) tag (transponder) which is then read by a R.F.I.D Transceiver.

□ Magnetic Stripe Cards:

- Tokens:

- to Swiped through a reader, no circuit.

- >→ Very easy to duplicate.

- ☐ H.O.T.P and T.O.T.P can be either hardware or software based.

- ☐ Cellphone software applications are more common now.

- to H.O.T.P (H.M.A.C-based One-Time Password):

- Shared secret and incremental counter, generate code when asked, valid till used.

- to T.O.T.P (Time-based One-Time Password):

- Time based with shared secret, often generated every 30 or 60 seconds, synchronized clocks are critical.

Something you are - Type 3 Authentication (Biometrics):

- Fingerprint, iris scan, facial geometry etcetera, these are also called realistic authentication.

- The subject uses these to authenticate their identity, if they are that, they must be who they say they are.

- Something that is unique to you, this one comes with more issues than the two other common authentication factors.

- We can allow unauthorized people into our facilities or systems if we accept someone by mistake. (False Accept)

- We can prevent our authorized people from

- entering our facilities if we refuse them by mistake. (False Reject).

Errors for Biometric Authentication:

- F.R.R (False rejection rate) Type 1 error:

- □ Authorized users are rejected.

- This can be too high settings - 99% accuracy on biometrics.

Image summary: A photo of a white biometric access control device featuring a numeric keypad at the top and a fingerprint scanner at the bottom. This device is designed to grant entry based on a combination of a passcode and a biometric scan.

Image summary: A graph plotting Errors against Sensitivity, showing two intersecting curves: the False Acceptance Rate (FAR), which decreases as sensitivity increases, and the False Reject Rate (FRR), which increases as sensitivity increases. The intersection of these two curves is labeled as the Crossover Error Rate (CER). The point is to illustrate the inverse relationship between FAR and FRR and how the CER represents the point where both error rates are equal.

- F.A.R (False accept rate) Type 2 error:

- Unauthorized user is granted access.

- This is a very serious error.

- We want a good mix of F.R.R and F.A.R where they meet on the graph is the C.E.R (Crossover Error Rate), this is where we want to be.

2 Definitions

Definition 1: Biometric identifiers: Unique physical or behavioral traits used to recognize individuals, such as fingerprints or voice patterns.

Definition 2: Behavioral characteristics: Unique patterns of how a person acts, such as their typing rhythm or voice, used for identification.

■ Biometric identifiers are often categorized as physiological and behavioral characteristics.

• Physiological Characteristics uses the shape of the body, these do not change unless a drastic event occurs.

Fingerprint, palm veins, facial recognition, D.N.A, palm print, hand geometry, iris recognition, retina, and odor.

Behavioral Characteristics uses the pattern of behavior of a person, these can change, but most often revert back to the baseline.

Typing rhythm, how you walk, signature and voice.

Issues with Biometric Authentication:

We also need to respect and protect our employee's privacy:

Some fingerprint patterns are related to chromosomal diseases.

Iris patterns could reveal genetic sex, retina scans can show if a person is pregnant or diabetic.

Hand vein patterns could reveal vascular diseases.

Most behavioral biometrics could reveal neurological diseases, etcetera

While passwords and smart cards should be safe because you keep them a secret and secure, biometrics is inherently not and something others can easily find out.

Attackers can take pictures of your face, your fingerprints, your hands, your ears and print good enough copies to get past a biometric scan.

It is possible to copy fingerprints from your high-resolution social media posts if you do a peace sign like the one on the right here.

How you type, sign your name and your voice pattern can be recorded, also not too difficult to cheat biometrics if it is worth the effort.

Some types are still inherently more secure, but they are often also more invasive.

• Lost passwords and I.D cards can be replaced with new different ones, biometrics can't.

Which should make us question even more the mass collection of biometric data.

When Home Depot loses 10 million credit card numbers it is bad, but they can be reissued.

The U.S Office of Personnel Management got hacked and lost 5.6 million federal employees' fingerprints.

• Authorization

- The F.B.I has a database with 52 million facial images and Homeland Security and U.S. Customs and Border Patrol is working on adding the iris scans and 170 million foreigner fingerprints to the F.B.I's database.

- The compromises of the future will have much more wide-reaching ramifications than the ones we have seen until now.

- What are you allowed to access?

- We use Access Control models. What and how we implement depends on the organization and what our security goals are.

- More on this in later when we cover D.A.C, mac, R.B.A.C, A.B.A.C, and R.U.B.A.C.

- Least Privilege and Need to Know.

- Least Privilege – (Minimum necessary access) Give users/systems exactly the access they need, no more, no less.

- Need to Know – Even if you have access, if you do not need to know, then you should not access the data.

- D.A.C (Discretionary Access Control) - Often used when Availability is most important:

- Access to an object is assigned at the discretion of the object owner.

- The owner can add, remove rights, commonly used by most O.S's.

- Uses D.A.C.L's (Discretionary A.C.L), based on user identity.

- mac (Mandatory Access Control) - Often used when Confidentiality is most important:

- Access to an object is determined by labels and clearance, this is often used in the military or in organizations where confidentiality is very important.

- Labels: Objects have Labels assigned to them; the subject's clearance must dominate the object's label.

- The label is used to allow Subjects with the right clearance access them.

- Labels are often more granular than just "Top Secret", they can be "Top Secret – Nuclear".

- Clearance: Subjects have Clearance assigned to them.

- Based on a formal decision on a subject's current and future trustworthiness.

- The higher the clearance the more in depth the background checks should be.

- R.B.A.C (Role-Based Access Control) - Often used when Integrity is most important:

- Policy neutral access control mechanism defined around roles and privileges.

Image summary: A diagram illustrating role-based access control, mapping users on the left to specific roles in the center, which then map to resources on the right. Users such as HR, Payroll, Sales, Finance, and IT Sec are assigned to one or more roles, and those roles are granted access to specific resources like Email, the Data center, Customer database, SAP, Time cards, and Employee records. The structure demonstrates how roles act as an intermediary layer to simplify the management of user permissions to system resources.

- A role is assigned permissions, and subjects in that role are added to the group, if they move to another position they are moved to the permissions group for that position.

- It makes administration of 1,000's of users and 10,000's of permissions much easier to manage.

- The most commonly used form of access control.

- If implemented right, it can also enforce separation of duties and prevent authorization/privilege creep.

- We move employees transferring within the organization from one role to another and we do not just add the new role to the old one.

A.B.A.C (Attribute-Based Access Control):

- Access to objects is granted based on subjects, objects, and environmental conditions.

- Attributes could be:

- Subject (user) – Name, role, I.D, clearance, etcetera

- Object (resource) – Name, owner, and date of creation.

- □ Environment – Location and/or time of access, and threat levels.

- Expected to be used by 70% of large enterprises within the next 5 years, versus around 25% today.

- Can also be referred to as policy-based

Context-Based Access Control:

Image summary: A diagram showing a user requesting access to patient records through a decision box labeled Allow Deny. The decision box is connected to an external feedback loop, indicating a mechanism that evaluates requests to either permit or block access to sensitive patient data.

Image summary: A diagram of an authorization engine that takes input from a set of policies and processes it via internal gears to output authorization decisions to various entities, including buildings, documents, users, and calendars. The system is designed to centrally manage and enforce access control policies across different resource types.

Who, what, when where, why, how

- access control (P.B.A.C) or claims-based access control (C.B.A.C).

- Access to an object is controlled based on certain contextual parameters, such as location, time, sequence of responses, access history.

- Providing the username and password combination followed by a challenge and response mechanism such as captcha, filtering the access based on mac addresses on wireless, or a firewall filtering the data based on packet analysis are all examples of context-dependent access control mechanisms.

Content-Based Access Control:

Access is provided based on the attributes or content of an object, then it is known as a content-dependent access control.

In this type of control, the value and attributes of the content that is being accessed determine the control requirements.

Hiding or showing menus in an application, views in databases, and access to confidential information are all content-dependent.

• Accountability (often referred to as Auditing):

Traces an Action to a Subject's Identity:

Proves who performed given action, it provides non-repudiation.

Group or shared accounts are never okay, they have zero accountability.

Uses audit trails and logs, to associate a subject with its actions.

Privacy

Non-repudiation.

- A user cannot deny having performed a certain action. This uses both Authentication and Integrity.

Subject and Object.

- Subject – (Active) Most often users but can also be programs – Subject manipulates Object.

- Object – (Passive) Any passive data (both physical paper and data) – Object is manipulated by Subject.

- Some can be both at different times, an active program is a subject; when closed, the data in program can be object.

Privacy is a human right.

- A definition of Privacy:

।Image summary: A diagram showing two users interacting with several objects, with arrows indicating that these interactions are captured and sent to a logs component. The structure illustrates a system for recording user activities with various objects into a centralized log.

1. The state or condition of being free from being observed or disturbed by other people.

2. Freedom from unauthorized intrusion.

You as a citizen and consumer have the right that your Personally Identifiable Information (P.I.I) is being kept securely.

U.S privacy regulation is a patchwork of laws, some overlapping and some areas with no real protection.

E.U Law – Strict protection on what is gathered, how it is used and stored.

Risk Management

Risk Management - Identification:

Risk = Threat * Vulnerability (or likelihood). We can also use Risk = Threat * Vulnerability * Impact.

Total Risk = Threat * Vulnerability * Asset Value.

Residual Risk = Total Risk - Countermeasures.

• Threat – A potentially harmful incident.

- Vulnerability – A weakness that can allow the Threat to do harm.

- Due Diligence: Doing the research before implementation. D.D – Do Detect

- Due Care: It is the implementation. D.C - Do Correct

Image summary: A diagram of a circular IT risk management process consisting of four sequential stages: IT Risk Identification, IT Risk Assessment, Risk Response and Mitigation, and Risk and Control Monitoring and Reporting. The stages are connected by arrows in a continuous loop, indicating that the process is an iterative cycle for managing IT risks.

The Risk Management lifecycle is iterative.

- Identify our Risk Management team.

- What is in and what is out of scope?

- Which methods are we using?

- Which tools are we using?

- What are the acceptable risk levels, which type of risk appetite do we have in our enterprise?

- Identify our assets.

- Tangible: Physical hardware, buildings, anything you can touch.

- Intangible: Data, trade secrets, reputation, etcetera

Risk Assessment.

- Quantitative and Qualitative Risk Analysis.

- Uncertainty analysis.

- Everything is done using cost-benefit analysis.

- Risk Mitigation/Risk Transference/Risk Acceptance/Risk Avoidance.

- Risk Rejection is never acceptable.

- We assess the current countermeasures.

- ☑ Are they good enough?

- Do we need to improve on them?

- Do we need to implement entirely new countermeasures?

• Qualitative versus Quantitative Risk Analysis.

Definition

I.T Risk: The potential for information technology systems or data to be compromised, leading to negative impacts on an organization.

Risk and Control Monitoring and Reporting I.T Risk Identification

Definition

Risk Response and Mitigation: Strategies and actions taken to reduce the likelihood or impact of identified risks.

Risk Response and Mitigation

- For any Risk analysis we need to identify our assets. What are we protecting?

- Qualitative Risk Analysis – How likely is it to happen and how bad is it if it happens?

Definition

Risk Assessment: The process of identifying potential risks, analyzing their likelihood and impact, and evaluating their significance.

I.T Risk Assessment

- Quantitative Risk Analysis – What will it actually cost us in dollars? This is fact-based analysis, Total dollar value of asset, math is involved.

- Qualitative Risk Analysis with the Risk Analysis Matrix.

- Let's pick an asset, a laptop.

- How likely is one to get stolen or left somewhere? I would think possible or likely.

- How bad is it if it happens? That really depends on a couple of things:

- Is it encrypted?

- Does it contain classified or P.I.I/F.I content?

Table summary: A risk assessment matrix that maps Likelihood against Consequences to determine risk levels. Risk levels increase from Low to Extreme as either likelihood or consequence grows. For example, a Rare likelihood with Insignificant consequences is rated L, while an Almost Certain likelihood with Catastrophic consequences is rated E. The highest risk level, E, is assigned to any event that is Almost Certain regardless of consequence, as well as any event with Catastrophic consequences unless it is Rare.

- Let's say it is likely and a minor issue, that puts the loss the high-risk category.

- It is normal to move high and extreme on the quantitative risk analysis. If mitigation is implemented, we can maybe move the risk level to "Low" or "Medium".

- A risk category to group similar risks.

- The risk breakdown structure identification number.

- A brief description or name of the risk to make the risk easy to discuss.

- The impact (or consequence) if event actually occurs rated on an integer scale.

- The probability or likelihood of its occurrence rated on an integer scale.

- The Risk Score (or Risk Rating) is the multiplication of Probability and Impact, and is often used to rank the risks.

- Common mitigation steps (e.g. within I.T projects)

- Identify

- ☑ Analyze

- Plan Response

- Monitor

- Control

• Quantitative Risk Analysis

: Table summary: This is an empty risk register template. It contains headers for Category, Name, Risk number, Probability, Impact, Mitigation, Contingency, Risk Score after Mitigation, Action By, and Action When, but no data is provided in the rows.

This is where we put a number on our assets and risks.

We find the asset's value: How much of it is compromised, how much one incident will cost, how often the incident occurs and how much that is per year.

Asset Value (A.V) – How much is the asset worth?

Exposure factor (E.F) – Percentage of Asset lost?

Single Loss Expectancy (S.L.E) = (A.V x E.F) - What does it cost if it happens once?

Annual Rate of Occurrence (A.R.O) – How often will this happen each year?

• Annualized Loss Expectancy (A.L.E) – This is what it costs per year if we do nothing.

Total Cost of Ownership (T.C.O) – The mitigation cost: upfront + ongoing cost (Normally Operational

Let's look at a few examples.

• Asset Value (A.V) equals The Laptop (1,000 dollars) plus P.I.I (10,000 dollars) per loss.

• Exposure factor (E.F) = It is a 100% loss, it is gone.

- Single Loss Expectancy (S.L.E) = (A.V x E.F) = Loss per laptop is $11,000 x 100%.

• Annual Rate of Occurrence (A.R.O) = The organization loses 25 Laptops Per Year.

• Annualized Loss Expectancy (A.L.E) = The annualized loss is $275,000

• Total Cost of Ownership (T.C.O) = $100,000

• Types of risk responses:

- Accept the Risk – We know the risk is there, but the mitigation is more costly than the cost of the risk (Low risks).

- Mitigate the Risk (Reduction) – The laptop encryption/wipe is an example – acceptable level (Leftover risk = Residual).

- Transfer the Risk – The insurance risk approach.

- Risk Avoidance – We don't issue employees laptops (if possible) or we build the data center in an area that doesn't flood.

- Risk Rejection – You know the risk is there, but you are ignoring it. This is never acceptable. (You are liable).

- Secondary Risk – Mitigating one risk may open up another risk.

K.G.I (Key Goal Indicator):

- Define measures that tell management, after the fact—whether an I.T process has achieved its business requirements.

K.P.I (Key Performance Indicators):

- Define measures that determine how well the I.T process is performing in enabling the goal to be reached.

K.R.I (Key Risk Indicators):

- Metrics that demonstrate the risks that an organization is facing or how risky an activity is.

- They are the mainstay of measuring adherence to and establishing enterprise risk appetite.

- Key risk indicators are metrics used by organizations to provide an early signal of increasing risk exposures in various areas of the enterprise.

- K.R.I give an early warning to identify potential event that may harm continuity of the activity/project.

Risk Response and Mitigation

- Risk mitigation, transference, acceptance, or avoidance.

- We act on senior management choices, which they made based on our recommendations from the assessment phase.

Risk and Control Monitoring and Reporting I.T Risk Identification

2 Definitions

Definition 1: Full-disk encryption: A security method that encrypts all data stored on a computer's hard drive, making it unreadable without a key.

Definition 2: Remote wipe capabilities: The ability to erase all data from a device from a distance, typically used to protect sensitive information if a device is lost or stolen.

Risk Response and Mitigation I.T Risk Assessment - Do we stop issuing laptops, or do we add full-disk encryption and remote wipe capabilities?

- Update the risk register, with the mitigations, and the risk responses.

• Risk and Control Monitoring and Reporting

- The process is ongoing, we have to keep monitoring both the risk and the controls we implemented.

- This is where we could use the K.R.I's (Key Risk Indicators)

- We would also use K.P.I's (Key Performance Indicators)

- It is normal to do the Risk Management lifecycle on an annual basis and do out-of-cycle Risk Management on critical items.

Access Control Categories and Types

• Access Control Categories:

- Administrative (Directive) Controls:

- Organizational policies and procedures.

- Regulation.

- Training and awareness.

- Technical (Logical) Controls:

- Risk and Control Monitoring and Reporting

I.T Risk Identification

Risk Response and Mitigation

- Hardware/software/firmware – Firewalls, routers, encryption.

- Physical Controls:

- Locks, fences, guards, dogs, gates, bollards.

• Access Control Types:

- Access Control Types (Many can be multiple types – On the exam look at question content to see which type it is).

- Preventative:

- Prevents action from happening – Least privilege, drug tests, I.P.S, firewalls, encryption.

- Detective:

- □ Controls that Detect during or after an attack – I.D.S, C.C.T.V, alarms, anti-virus.

- Corrective:

- □ Controls that Correct an attack – Anti-virus, patches, I.P.S.

- Recovery:

- □ Controls that help us Recover after an attack – D.R Environment, backups, H.A Environments.

- Deterrent:

I.T Risk Assessment - □ Controls that Deter an attack – Fences, security guards, dogs, lights, Beware of the dog signs.

- Compensating:

- Controls that Compensate – When other controls are impossible or too costly to implement.

The Ethics of Your Organization and I.S.C.2

• I.S.C.2 Code of Ethics

- You agree to this before the exam, and the code of ethics is very testable.

- Understand the preamble and the 4 ethics canons, but they should not be a substitute for the ethical judgment of the professional.

- Code of Ethics Preamble:

- The safety and welfare of society and the common good, duty to our principles, and to each other, requires that we adhere, and be seen to adhere, to the highest ethical standards of behavior.

- Therefore, strict adherence to this code is a condition of certification.

Code of Ethics Canons:

- Protect society, the common good, necessary public trust and confidence, and the infrastructure.

- Act honorably, honestly, justly, responsibly, and legally.

- Provide diligent and competent service to principles.

- Advance and protect the profession.

Computer Ethics Institute:

- Thou shalt not use a computer to harm other people.

- Thou shalt not interfere with other people's computer work.

- Thou shalt not snoop around in other people's computer files.

- Thou shalt not use a computer to steal.

- Thou shalt not use a computer to bear false witness.

- Thou shalt not copy or use proprietary software for which you have not paid.

- Thou shalt not use other people's' computer resources without authorization or proper compensation.

- Thou shalt not appropriate other people's' intellectual output.

- Thou shalt think about the social consequences of the program you are writing or the system you are designing.

- Thou shalt always use a computer in ways that ensure consideration and respect for your fellow humans.

• Your Organization's Ethics:

You need to know the Internal Code of Ethics of your organization

If you don't, how can you adhere to it?

Governance versus Management

- Governance – This is C-level Executives.

- Stakeholder's needs, conditions and options are evaluated to define:

- ☐ Balanced agreed-upon enterprise objectives to be achieved.

- Setting direction through prioritization and decision making.

- □ Monitoring performance and compliance against agreed-upon direction and objectives.

- Risk appetite – Aggressive, neutral, adverse.

Image summary: A diagram illustrating a governance cycle where business needs from the board and owners flow into an upper loop of directing, monitoring, and evaluating. This upper loop provides direction to and receives feedback from a lower operational process consisting of planning (APO), building (BAI), running (DSS), and monitoring (MEA). The structure shows how strategic oversight drives and is informed by the tactical execution of business processes.

• Management – How do we get to the destination.

Plans, builds, runs, and monitors activities in alignment with the direction set by the governance to achieve the objectives.

Risk tolerance – How are we going to practically work with our risk appetite and our environment.

C-Level Executives (Senior

Leadership) – Ultimately Liable.

- C.E.O: Chief Executive Officer.

- C.I.O: Chief Information Officer.

- C.T.O: Chief Technology Officer.

- C.S.O: Chief Security Officer.

- C.I.S.O: Chief Information Security Officer.

- C.F.O: Chief Financial Officer.

- Normal organizations obviously have more C-Level executives, the ones listed here you need to know.

Image summary: An organizational chart showing the hierarchy of a company. The Board of Directors (BOD) sits at the top, overseeing the Chairman, Directors, and several committees including IT Strategy and IT Steering. The CEO reports to the BOD and manages a leadership team consisting of the CISO, CIO, CHRO, COO, and CFO. Below the CISO and CIO are specialized managers for security, networks, data centers, and applications. The structure depicts a formal corporate governance model where strategic oversight flows from the board down through executive leadership to operational management.

Laws and Regulations

There are a handful types of laws covered on the exam and important to your job as an I.T Security Professional.

Criminal Law:

“Society” is the victim and proof must be “Beyond a reasonable doubt”.

Incarceration, death, and financial fines to “Punish and deter”.

Civil Law (Tort Law):

Individuals, groups or organizations are the victims and proof must be "The majority of proof".

• Financial fines to “Compensate the victim(s)”.

Administrative Law (Regulatory Law):

Laws enacted by government agencies (F.D.A Laws, hipaa, F.A.A Laws, etcetera)

Private Regulations:

Compliance is required by contract (For instance P.C.I-D.S.S).

Customary Law:

Mostly handles personal conduct and patterns of behavior and it is founded in traditions and customs of the area or region.

Religious Law:

Based on the religious beliefs in that area or country, they often include a code of ethics and moralities which are required to be upheld.

• Rules, Regulations and Laws:

- hipaa: Health Insurance Portability and Accountability Act.

- Strict privacy and security rules on handling of F.I (Protected Health Information).

- Security Breach Notification Laws.

- Electronic Communications Privacy Act (E.C.P.A):

- Protection of electronic communications against warrantless wiretapping.

- The Act was weakened by the Patriot Act.

- Patriot Act of 2001:

• Expands law enforcement electronic monitoring capabilities.

- Allows search and seizure without immediate disclosure.

- Computer Fraud and Abuse Act (C.F.A.A) – Title 18 Section 1030:

- Most commonly used law to prosecute computer crimes.

- Payment Card Industry Data Security Standard (P.C.I-D.S.S)

- Technically not a law, created by the payment card industry.

The standard applies to cardholder data for both credit and debit cards.

• Requires merchants and others to meet a minimum set of security requirements.

Mandates security policy, devices, control techniques, and monitoring.

not Federal, all 50 states have individual laws, know your state.

• G.D.P.R

G.D.P.R is a regulation in E.U law on data protection and privacy for all individuals within the European Union (E.U) and the European Economic Area (E.E.A).

It does not matter where we are based, if we have customers in E.U/EEA we have to adhere to the G.D.P.R.

Violators of the G.D.P.R may be fined up to €20 million or up to 4% of the annual worldwide turnover of the preceding financial year in case of an enterprise, whichever is greater.

Restrictions: Lawful Interception, national security, military, police, justice system

Right to access: Data controllers must be able to provide a free copy of an individual's data if requested.

Personal data: Covers a variety of data types including: Names, Email Addresses, Addresses, Unsubscribe confirmation U.R.L's that contain email and/or names, I.P Addresses.

Right to erasure: All users have a “right to be forgotten”.

Data portability: All users will be able to request access to their data "in an electronic format".

Data breach notification: Users and data controllers must be notified of data breaches within 72 hours.

Privacy by design: When designing data processes, care must be taken to ensure personal data is secure. Companies must ensure that only data is “absolutely necessary for the completion of duties”.

Data protection officers: Companies whose activities involve data processing and monitoring must appoint a data protection officer.

Information Security Governance: Values, vision, mission, and plans

• Security governance principles.

Values:

What are our values? Ethics, Principles, Beliefs.

Vision:

What do we aspire to be? Hope and Ambition.

Mission:

Who do we do it for? Motivation and Purpose.

Strategic Objectives:

♦ How are we going to progress? Plans, goals, and sequencing.

thorteaches dot com Our values

Business Vision

Business Objectives

I.T Strategy

I.T Security Strategy

Security Policies

Security Standards

Security Processes

Security Metrics (K.P.I's and Actions)

Thor's Study Guide – C.C Domain 1

Image summary: A diagram illustrating a corporate planning and policy hierarchy. The top section shows a timeline from Year 1 to Year 5, mapping Governance to a long-term strategic plan, Management to a one-year tactical plan, and Staff to a frequently updated operational plan. Below this, a pyramid depicts a hierarchy of governance documents, ranging from high-level values and vision at the top to specific security metrics, KPIs, and actions at the base. The overall point is to show the alignment between organizational roles, planning timeframes, and the granularity of policies and standards.

Thor's Study Guide – C.C Domain 1

Domain 1: What we covered

- This chapter is very important because:

- Every other knowledge domain builds on top of this chapter

- This is the foundation.

We talked about:

- The differences between Information Security, I.T Security, and Cybersecurity.

- The C.I.A triad and I.A.A.A.

- Privacy.

- Risk and incident management.

- Access control.

- The I.S.C.2 ethics.

- Governance, management, laws, and regulations.

You have reached the end of the document.