104
Flash Cards – Domain 7: Security Operations
Here’s a concise CISSP summary to help you with last-minute revision. These notes focus on core concepts from each domain based on CISSP Official Study Guide 10th Edition.
🌍 CISSP Quick Notes – Key Concepts
📌 Domain 1: Security & Risk Management
- CIA Triad: Confidentiality, Integrity, Availability.
- Risk Assessment: Identify, Analyze, Prioritize risks.
- Security Frameworks: NIST, ISO 27001, COBIT.
- Policies & Governance: Security policies (Acceptable Use, Access Control, etc.).
- Disaster Recovery (DR) & Business Continuity Plan (BCP).
🔒 Domain 2: Asset Security
- Data Classification: Public, Internal, Confidential, Restricted.
- Data Retention & Disposal: Secure erase, degaussing.
- Privacy Regulations: GDPR, HIPAA, PCI-DSS.
- Storage & Protection: Encryption, Masking, Tokenization.
🔐 Domain 3: Security Architecture & Engineering
- Security Models: Bell-LaPadula (Confidentiality), Biba (Integrity), Clark-Wilson.
- Access Control Mechanisms: MAC, DAC, RBAC.
- Cryptography: Symmetric vs. Asymmetric, Hashing, Digital Signatures.
- Zero Trust Architecture: “Never Trust, Always Verify.”
🛡️ Domain 4: Communication & Network Security
- Networking Basics: OSI Model (7 Layers), TCP/IP.
- Common Attacks: DoS, DDoS, Man-in-the-Middle (MITM).
- Wireless Security: WPA3, 802.11 security protocols.
- Firewalls: Packet filtering, Stateful, NGFW.
- Network Segmentation: VLANs, SDN, NAC.
🔑 Domain 5: Identity & Access Management (IAM)
- Authentication Types: Something you KNOW (password), HAVE (token), ARE (biometrics).
- Federated Identity Management: SAML, OAuth, OpenID.
- Privileged Access Management (PAM).
- Multifactor Authentication (MFA): Combining two factors.
- Single Sign-On (SSO): One login, multiple access.
⚙️ Domain 6: Security Assessment & Testing
- Vulnerability Scanning vs Pen Testing.
- Static & Dynamic Application Security Testing (SAST/DAST).
- Security Audits: SOC 2, ISO 27001.
- Threat Hunting: Proactive analysis for adversary activity.
🚀 Domain 7: Security Operations
- Incident Response Process: Detect → Contain → Eradicate → Recover → Lessons Learned.
- SIEM & Logging: Event correlation, log analysis.
- Endpoint Security: EDR, XDR, Antivirus.
- Malware & Threat Intelligence: Indicators of Compromise (IoCs), TTPs.
- Secure Software Development: OWASP Top 10, DevSecOps.
💻 Domain 8: Software Development Security
- SDLC (Software Development Lifecycle): Planning → Development → Testing → Deployment.
- Secure Coding Practices: Input Validation, Least Privilege.
- Database Security: SQL Injection prevention, Encryption.
- API Security: OAuth 2.0, Rate Limiting, Secure Tokens.
🎯 Final Tips
- Focus on risk-based thinking—CISSP questions often ask what is the best security decision.
- Think like a security professional—protecting assets, minimizing risk, ensuring compliance.
- Practice timed mock exams—familiarize yourself with tricky wording.
- Don’t overthink—eliminate wrong answers first, then pick the best option.
You’re in the final stretch—keep going! 🚀 Let me know if you need deeper explanations on any topic. 💪
Flash Cards – Domain 7: Security Operations
Incident Response Process
A systematic approach for handling security breaches, involving detection, containment, eradication, recovery, and lessons learned.
Security Information and Event Management (SIEM)
A system that collects, correlates, and analyzes log data from various sources to identify suspicious activities in real time.
Endpoint Detection and Response (EDR)
Tools that provide continuous monitoring, threat detection, and automated response for endpoints under attack.
Extended Detection and Response (XDR)
An integrated security solution that correlates data across endpoints, networks, and cloud services to produce comprehensive threat insights.
Malware
Malicious software designed to damage, disrupt, or gain unauthorized access to systems.
Threat Intelligence
The collection, analysis, and application of data about potential and current threats to improve an organization’s defensive measures.
Indicators of Compromise (IoCs)
Artifacts or pieces of information—such as IP addresses, file hashes, or URLs—that indicate a potential security breach or malicious activity.
Security Operations Center (SOC)
A dedicated facility where security teams monitor, detect, analyze, and respond to cybersecurity incidents around the clock.
Log Management
The process of collecting, storing, and analyzing logs from various systems to aid in identifying and investigating security incidents.
