|
To Contact Me |
|
Phone: 07768 113497 Fax: 01473 423491 |
|
CISSP Domain 7 : OPERATIONS SECURITY (page 1) |
|
Home Page | Network Penetration Testing | Firewall and VPN Engineering | Network Design | Security Policy | Network Support | Employment / Contract History | CV and References | Personal |
|
.Overview Operations Security is used to identify the controls over hardware, media, and the operators with access privileges to any of these resources. Audit and monitoring is the mechanisms, tools and facilities that permit the identification of security events and subsequent actions to identify the key elements and report the pertinent information to the appropriate individual, group, or process. The candidate will be expected to know the resources that must be protected, the privileges that must be restricted, the control mechanisms available, the potential for abuse of access, the appropriate controls, and the principles of good practice. Key Areas of Knowledge § Administrative Management § Job Requirements/Specifications § Background Checking § Separation of Duties and Responsibilities § Least Privilege § Job Rotation § Mandatory taking of vacation in one week increments § Terminations § Concepts § Anti-Virus management § Backup of Critical information § Changes in workstation/location § Need-to-Know/Least Privilege § Privileged operations functions § Standards of Due Care/Due Diligence § Privacy and protection § Legal requirements § Illegal activities (fraud detection, collusion) § Record retention § Sensitive information and media § Marking § Handling § Storage § Destruction § Control Types § Directive controls § Preventive controls § Detective controls § Corrective controls § Recovery controls § Operations Controls § Resource protection § Privileged-entity controls § Change Control Management § Hardware controls § Input/Output controls § Media controls § Administrative controls (separation of duties and responsibilities, rotation of duties, least privilege, etc.) § Trusted Recovery Process § Resource Protection is required for § Communications hardware/software § Processing equipment § Password files § Application program libraries § Application source code § Vendor software § Operating system § System utilities § Directories and address tables § Proprietary packages § Main storage § Sensitive/critical data § System logs/audit trails § Violation report § Backup files § Sensitive forms and printouts § Auditing § Compliance checks § Internal and External § Frequency of review § Standard of Due Care § and Reporting Contd …. |