Domain 1 : Security & Risk Management

Question 1

Name the three types of security evaluations & briefly discuss what each type achieves?

Answer 1

Risk assessment, vulnerability assessment & PEN testing. Risk assessment is the process of identifying assets, threats, & vulnerabilities & using that information to calculate risk; vulnerability assessments use automated tools to locate security weaknesses and the results are used to add more defenses or adjust existing protections; PEN testing uses trusted 3rd party firms or individuals to stress-test the security infrastructure

Question 2

What is the CIA Triad ?

Answer 2

CIA = confidentiality, integrity, & availability which are the three primary goals of security infrastructure.
Security controls usually evaluated on how well they address the three core tenets (CIA)

Question 3

What are the five (5) categories of AAA Services core security mechanism & briefly describe the meaning of each area?

Answer 3

Identification, authentication, authorization, auditing, & accounting

Question 4

Name and discuss the concept of the four (4) protection mechanisms in cybersecurity (pp.11-13 CISSP text)

Answer 4

Defense in depth (layering) (meaning: use of multiple controls in a series:
use layering in series vs in parallel

Abstraction : used to create efficiencies by placing similar elements in to groups, classes, or roles to be assigned security controls,

Data hiding: exactly what it sounds like in cybersecurity

Encryption: in cyber security is the conversion of data from a readable format into an encoded format. Encrypted data can only be read or processed after it’s been decrypted

Question 5

What is the FAIR methodology?

Answer 5

FAIR stands for Factor Analysis of Information Risk and is a methodology of assessing security risk using quantitative analysis