Domain 7. Chapter 16

Question 1

Chapter 16. Managing Security Operations
Resource protection ensures that resources are securely provisioned when they’re deployed and throughout their lifecycle.
Configuration management ensures that systems are configured correctly, and change management processes protect against outages from unauthorized changes.
Patch and vulnerability management controls ensure that systems are up to date and protected against known vulnerabilities.

Question 2

1. Apply Foundational Security Operations Concepts
   1.1 Need-to-Know Access
   1.2 The Principle of Least Privilege
   1.3 Separation of Duties (SoD) and Responsibilities
   1.4 Two-Person Control
   1.5 Job Rotation
   1.6 Mandatory Vacations
   1.7 Privileged Account Management
   1.8 Service Level Agreements (SLAs)

Question 3

1.1 Need-to-Know Access
The need-to-know principle imposes the requirement to grant users access only to data or resources they need to perform assigned work tasks. The primary purpose is to keep secret information secret.
Need to know is commonly associated with security clearances, such as a person having a Secret clearance.
Restricting access based on a need to know helps protect against unauthorized access that could result in a loss of confidentiality.

Question 4

1.2 The Principle of Least Privilege
The least privilege principle states that subjects are granted only the privileges necessary to perform assigned work tasks and no more. Keep in mind that privilege in this context includes both permissions to data and rights to perform systems tasks.

Limiting and controlling privileges based on this concept protects confidentiality and data integrity.

Question 5

1.3 Separation of Duties (SoD) and Responsibilities
Separation of duties (SoD) and responsibilities ensures that no single person has total control over a critical function or system. This is necessary to ensure that no single person can compromise the system or its security. Instead, two or more people must conspire or collude against the organization, which increases the risk for these people.

A separation of duties policy creates a checks-and-balances system where two or more users verify each other’s actions and must work in concert to accomplish necessary work tasks.
Similarly, organizations often break down processes into multiple tasks or duties and assign these duties to different individuals to prevent fraud.

Answer 5

conspire or collude сговориться или сговориться
checks-and-balances система сдержек и противовесов

Question 6

1.4 Two-Person Control
Two-person control (sometimes called the two-man rule) requires the approval of two individuals for critical tasks.
For example, safe deposit boxes in banks often require two keys.
Using two-person controls within an organization ensures peer review and reduces the likelihood of collusion and fraud. For example, an organization can require two individuals within the company (such as the chief financial officer and the chief executive officer) to approve key business decisions.

Split knowledge combines the concepts of separation of duties and two-person control into a single solution. The basic idea is that the information or privilege required to perform an operation is divided among two or more users. This ensures that no single person has sufficient privileges to compromise the security of the environment.

Question 7

1.5 Job Rotation
Job rotation (sometimes called rotation of duties) means that employees rotate through jobs or rotate job responsibilities with other employees.
Using job rotation as a security control provides peer review, reduces fraud, and enables cross-training. Cross-training helps make an environment less dependent on any single individual.

Answer 7

Ротация должностей (иногда называемая ротацией обязанностей) означает, что сотрудники чередуют должности или чередуют рабочие обязанности с другими сотрудниками.
Использование ротации должностей в качестве средства контроля безопасности обеспечивает экспертную оценку, снижает уровень мошенничества и обеспечивает перекрестное обучение. Перекрестное обучение помогает сделать среду менее зависимой от какого-либо отдельного человека.

Question 8

1.6 Mandatory Vacations
Many organizations require employees to take mandatory vacations in one-week or two-week increments.
This provides a form of peer review and helps detect fraud and collusion. This policy ensures that another employee takes over an individual’s job responsibilities for at least a week. If an employee is involved in fraud, the person taking over the responsibilities is likely to discover it.

Financial organizations are at risk of significant losses from fraud by employees. They often use job rotation, separation of duties and responsibilities, and mandatory vacation policies to reduce these risks. Combined, these policies help prevent incidents and help detect them when they occur.

Answer 8

Многие организации требуют, чтобы сотрудники брали обязательные отпуска с интервалом в одну или две недели.
peer review экспертная оценка
Это обеспечивает форму экспертной оценки и помогает выявить мошенничество и сговор. Эта политика гарантирует, что другой сотрудник возьмет на себя рабочие обязанности человека как минимум на неделю. Если сотрудник замешан в мошенничестве, лицо, принимающее на себя ответственность, скорее всего, обнаружит это.

Финансовые организации рискуют понести значительные убытки от мошенничества со стороны сотрудников. Чтобы снизить эти риски, они часто используют ротацию должностей, разделение обязанностей и ответственности, а также политику обязательных отпусков. В совокупности эти политики помогают предотвращать инциденты и обнаруживать их при возникновении.

Question 9

1.7 Privileged Account Management
Privileged account management (PAM) solutions restrict access to privileged accounts or detect when accounts use any elevated privileges.
In this context, privileged accounts are administrator accounts or any accounts that have specific elevated privileges. This can include help desk workers who have been granted limited privileges to perform certain activities.
Many automated tools are available that can monitor the usage of special privileges. When an administrator or privileged operator performs one of these activities, the tool can log the event and send an alert. Additionally, access review audits detect misuse of these privileges.

Answer 9

Решения для управления привилегированными учетными записями (PAM) ограничивают доступ к привилегированным учетным записям или определяют, когда учетные записи используют какие-либо повышенные привилегии.
В этом контексте привилегированные учетные записи — это учетные записи администратора или любые учетные записи, имеющие определенные повышенные привилегии. Сюда могут входить сотрудники службы поддержки, которым предоставлены ограниченные права на выполнение определенных действий.

Question 10

1.8 Service Level Agreements (SLAs)
A service level agreement (SLA) is an agreement between an organization and an outside entity, such as a vendor. The SLA stipulates (оговариваетб определяет) performance expectations and often includes penalties if the vendor doesn’t meet these expectations.

As an example, many organizations use cloud-based services to rent servers

Question 11

2. Addressing Personnel Safety and Security
   Organizations should implement security controls that enhance personnel safety.
   2.1 Duress
   2.2 Travel
   2.3 Emergency Management
   2.4 Security Training and Awareness

Answer 11

Duress - давление
принуждение
заключение
You can add a meaning to your dictionary
лишение свободы

Question 12

2.1 Duress
Duress systems are useful when personnel are working alone.
A simple duress system is just a button that sends a distress call. A monitoring entity receives the distress call and responds based on established procedures. The monitoring entity could initiate a phone call or text message back to the person who sent the distress call. In this example, the guard responds by confirming the situation.
Some electronic cipher locks support two or more codes, such as one for regular use and one to raise an alarm. Normally, employees would enter a code (such as 1 2 3 4) to open the door to a secure area. In a duress situation, they could enter a different code (such as 5 6 7 8) that would open the door and set off a silent alarm.

Answer 12

Простая система принуждения — это всего лишь кнопка, которая отправляет сигнал бедствия. Объект мониторинга получает сигнал бедствия и отвечает на него в соответствии с установленными процедурами. Объект мониторинга может инициировать телефонный звонок или текстовое сообщение обратно лицу, отправившему сигнал бедствия. В этом примере охранник отвечает, подтверждая ситуацию.

Question 13

2.2 Travel
Another safety concern is when employees travel because criminals might target an organization’s employees while they are traveling.
This includes simple things such as verifying a person’s identity before opening the hotel door.

Employees should also be warned about the many risks associated with electronic devices (such as smartphones, tablets, and laptops) when traveling. These risks include the following:

• Sensitive Data Ideally, the devices should not contain any sensitive data. This prevents the loss of data if the devices are lost or stolen. If an employee needs this data while traveling, it should be protected with strong encryption.
• Malware and Monitoring Devices There have been many reported cases of malware being installed on systems while employees were visiting a foreign country. However, this is more than enough time for someone who otherwise looks like hotel staff to enter your room, install malware in the operating system, and install a physical listening device inside the computer. Maintaining physical control of devices at all times can prevent these attacks. Security experts recommend that employees do not bring their personal devices but instead bring temporary devices to be used during the trip. After the trip, these can be wiped clean and reimaged.
• Free Wi-Fi Free Wi-Fi often sounds appealing while traveling. However, it can easily be a trap configured to capture all the user’s traffic. Instead, users should have a method of creating their own internet connection, such as through a smartphone or with a mobile wireless hotspot device.
• VPNs Employers should have access to virtual private networks (VPNs) that they can use to create secure connections. These can be used to access resources in the internal network, including their work-related email.

Question 14

2.3 Emergency Management
Emergency management plans and practices help an organization address personnel safety and security after a disaster. “Disaster Recovery Planning.”

Question 15

2.4 Security Training and Awareness
Chapter 2, “Personnel Security and Risk Management Concepts,”. If an organization has a training and awareness program in place, it’s relatively easy to add personnel safety and security topics. These programs help ensure that personnel are aware of duress systems, travel best practices, emergency management plans, and general safety and security best practices.

Question 16

3. Provision Resources Securely
   3.1 Information and Asset Ownership
   3.2 Asset Management
   3.3 Hardware Asset Inventories
   3.4 Software Asset Inventories
   3.5 Intangible Inventories

Question 17

3.1 Information and Asset Ownership
The key point is that by identifying the assets’ owners, an organization also identifies the individuals responsible for protecting those assets. Data owners typically delegate data protection tasks to others in the organization. For example, employees in the data custodian security role typically perform daily tasks such as implementing access controls, performing backups, and managing data storage.

Question 18

3.2 Asset Management
Asset management refers to managing both tangible and intangible assets. This typically starts with inventories of assets, tracking the assets, and taking additional steps to protect them throughout their lifetime.
Tangible assets include hardware and software assets owned by the company. Intangible assets include patents, copyrights, a company’s reputation, and other assets representing potential revenue. By managing assets successfully, an organization prevents losses.
Many organizations use an automated configuration management system (CMS) to help with hardware asset management.

Answer 18

tangible and intangible assets. материальное и нематериальное
inventories of assets инвентаризация активов

Question 19

3.3 Hardware Asset Inventories
Hardware assets are IT resources such as computers, servers, routers, switches, and peripherals. Many organizations use databases and inventory applications to perform inventories and track hardware assets through the entire equipment lifecycle. For example, bar-code systems are available that can print bar codes to place on equipment. The bar-code database includes relevant details on the hardware, such as the model, serial number, and location. When the hardware is purchased, it is bar-coded before it is deployed. On a regular basis, personnel scan all of the bar codes with a bar-code reader to verify that the organization still controls the hardware.

A similar method uses radio frequency identification (RFID) tag.
It’s easy for individuals to lose sight of the data that it contains, so using checklists to sanitize the system is often valuable.

Answer 19

bar-code штрих-кода
Людям легко потерять из виду содержащиеся в них данные, поэтому использование контрольных списков для очистки системы часто бывает полезным.

Question 20

3.4 Software Asset Inventories
Software assets are operating systems and applications.
. Organizations pay for software, and license keys are routinely used to activate the software. The activation process often requires contacting a licensing server over the internet to prevent piracy. If the license keys are leaked outside the organization, it can invalidate the organization’s use. It’s also important to monitor license compliance to avoid legal issues.
Software licensing also refers to ensuring that systems do not have unauthorized software installed. Many tools are available that can inspect systems remotely to detect the system’s details. This allows them to identify unauthorized software running on systems, and helps an organization ensure that it complies with software licensing rules.

Question 21

3.5 Intangible Inventories
The senior management team is typically the owner of these assets. Large organizations report the value of intangible assets on their balance sheets using generally accepted accounting principles (GAAP). This helps them review their intangible assets at least annually.

Answer 21

Крупные организации отражают стоимость нематериальных активов в своих балансах, используя общепринятые принципы бухгалтерского учета (GAAP). Это помогает им пересматривать свои нематериальные активы не реже одного раза в год.

Question 22

4. Apply Resource Protection
   Organizations apply various resource protection techniques to ensure that resources are provisioned securely and managed throughout their lifecycle.
   4.1 Media Management
   4.2 Media Protection Techniques
   4.3 Tape Media
   4.4 Mobile Devices
   4.5 Managing Media Lifecycle

Answer 22

Организации применяют различные методы защиты ресурсов, чтобы обеспечить безопасное предоставление ресурсов и управление ими на протяжении всего их жизненного цикла.

Question 23

4.1 Media Management
Media management refers to the steps taken to protect media and data stored on media. In this context, media is anything that can hold data.
However, media management extends beyond just backup tapes to any type of media that can hold data. It also includes any type of hard-copy data.

Answer 23

Однако управление носителями выходит за рамки просто резервных лент и включает носители любого типа, на которых могут храниться данные. Сюда также входят любые типы бумажных данных.

Question 24

4.2 Media Protection Techniques
When media includes sensitive information, it should be stored in a secure location with strict access controls to prevent losses due to unauthorized access. Additionally, any location used to store media should have temperature and humidity controls to prevent losses due to corruption. Media management can also include technical controls to restrict device access from computer systems.
Properly managing media directly addresses confidentiality, integrity, and availability.

Question 25

4.3 Tape Media
Organizations commonly store backups on tapes, and tapes are highly susceptible to loss due to corruption. As a best practice, organizations should keep at least two copies of backups. They should maintain one copy on site for immediate usage if necessary and store the second copy at a secure location off site.

Here are some useful guidelines for managing tape media:

• Keep new media in its original sealed packaging until it’s needed to protect it from dust and dirt.
• When opening a media package, take extra caution not to damage the media in any way. This includes avoiding sharp objects and not twisting or flexing the media.
• Avoid exposing the media to temperature extremes; it shouldn’t be stored close to heaters, radiators, air conditioners, or other sources of extreme temperatures.
• Do not use media that has been damaged, exposed to abnormal levels of dust and dirt, or dropped.
• Media should be transported from one site to another in a temperature-controlled vehicle.
• Media should be protected from exposure to the outside environment; avoid sunlight, moisture, humidity, heat, and cold. It should be acclimated for 24 hours before use.
• Appropriate security should be maintained over media from the point of departure to the secured offsite storage facility. Media is vulnerable to damage and theft at any point during transportation.
• Appropriate security should be maintained over media throughout the lifetime of the media based on the classification level of data on the media.
• Consider encrypting backups to prevent unauthorized disclosure of data if the backup tapes are lost or stolen.

Question 26

4.4 Mobile Devices
The key is to remember that mobile devices include data storage abilities. If they are storing sensitive data, it’s important to take steps to protect that data.

Question 27

4.5 Managing Media Lifecycle
All media has a useful but finite lifecycle. Reusable media is subject to a mean time to failure (MTTF) that is sometimes represented in the number of times it can be reused or the number of years you can expect to keep it. It’s important to monitor backups for errors and use them as a guide to gauge the lifetime in your environment. Once backup media has reached its MTTF, it should be destroyed. The classification of data held on the tape will dictate the method used to destroy the media.

Question 28

5. Managed Services in the Cloud
   For example, the Department of Defense (DoD) Cloud Computing Security Requirements Guide (CC SRG) defines specific requirements for U.S. government agencies to follow when evaluating the use of cloud computing assets.

For example, the Department of Defense (DoD) Cloud Computing Security Re

Question 29

5.1 Shared Responsibility with Cloud Service Models
- Software as a Service (SaaS) Software as a service (SaaS) models provide fully functional applications typically accessible via a web browser. For example, Google’s Gmail is an SaaS application. The vendor (Google in this example) is responsible for all maintenance of the SaaS services. Customers do not manage or control any of the cloud-based assets.
- Platform as a Service (PaaS) Platform as a service (PaaS) models provide consumers with a computing platform, including hardware, operating systems, and a runtime environment. The runtime environment includes programming languages, libraries, services, and other tools supported by the vendor. Customers deploy applications that they’ve created or acquired, manage their applications, and possibly modify some configuration settings on the host. However, the vendor is responsible for maintenance of the host and the underlying cloud infrastructure.
Infrastructure as a Service (IaaS) Infrastructure as a service - (IaaS) models provide basic computing resources to customers. This includes servers, storage, and networking resources. Customers install operating systems and applications and perform all required maintenance on the operating systems and applications. The vendor maintains the cloud-based infrastructure, ensuring that consumers have access to leased systems.

Question 30

5.1
NIST SP 800-145, The NIST Definition of Cloud Computing, provides standard definitions for many cloud-based services. This includes definitions for service models (SaaS, PaaS, and IaaS), and definitions for deployment models (public, private, community, and hybrid). NIST SP 800-144, Guidelines on Security and Privacy in Public Cloud Computing, provides in-depth details on security issues related to cloud-based computing.

Question 31

5.2 The four cloud deployment models available are as follows:
- A public cloud model includes assets available for any consumers to rent or lease and is hosted by an external CSP. Service-level agreements can effectively ensure that the CSP provides the cloud-based services at a level acceptable to the organization.
- The private cloud deployment model is used for cloud-based assets for a single organization. Organizations can create and host private clouds using their own on-premises resources. If so, the organization is responsible for all maintenance. However, an organization can also rent resources from a third party for exclusive use of the organization. Maintenance requirements are typically split based on the service model (SaaS, PaaS, or IaaS).
- A community cloud deployment model provides cloud-based assets to two or more organizations that have a shared concern, such as a similar mission, security requirements, policy, or compliance considerations. Assets can be owned and managed by one or more of the organizations. Maintenance responsibilities are shared based on who is hosting the assets and the service models.
- A hybrid cloud model includes a combination of two or more clouds that are bound together by a technology that provides data and application portability. Similar to a community cloud model, maintenance responsibilities are shared based on who is hosting the assets and the service models in use.

Question 32

5.3 Scalability and Elasticity
Scalability refers to the ability of a system to handle additional workloads by adding additional resources.
Elasticity refers to a system’s ability to add and remove resources dynamically, based on increasing or decreasing load.

Question 33

6. Perform Configuration Management (CM)
   Configuration management (CM) helps ensure that systems are deployed in a secure, consistent state and that they stay in a secure, consistent state throughout their lifetime. Baselines and images are commonly used to deploy systems.

Question 34

6.1 Provisioning
Provisioning new systems refers to installing and configuring the operating system and needed applications. Deploying operating systems and applications using all of the defaults typically enables many vulnerabilities. Instead, new systems should be configured to reduce the vulnerabilities.
Hardening a system makes it more secure than the default configuration and includes the following:

Disable all unused services. As an example, a file server needs services that allow users to access files, but file servers rarely use FTP. If the server is not using FTP, it should be disabled.
Close all unused logical ports. These are often closed by disabling unused services.
Remove all unused applications. Some applications automatically add additional applications. If these aren’t used, they should be removed.
Change default passwords. Many applications have default passwords for some accounts. Attackers know these, so the passwords should be changed.

Question 35

6.2 Baselining
A baseline is a starting point. In the context of configuration management, it is the starting configuration for a system. An easy way to think of a baseline is as a list of settings. An operating system baseline identifies all the settings to harden specific systems.

Question 36

6.3 Using Images for Baselining
Many organizations use images to deploy baselines. Figure 16.2 shows the process of creating and deploying baseline images in an overall three-step process. Here are the steps:
1. An administrator starts by installing the operating system and all desired applications on a computer (labeled as the baseline system in the figure). The administrator then configures the system with relevant security and other settings to meet the organization’s needs. Personnel then perform extensive testing to ensure that the system operates as expected before proceeding to the next step.
2. Next, the administrator captures an image of the system using imaging software and stores it on a server (labeled as an Image Server in the figure). It’s also possible to store images on external hard drives, USB drives, or DVDs.
3. Personnel then deploy the image to systems as needed. These systems often require additional configuration to finalize them, such as giving them unique names. However, the overall configuration of these systems is the same as the baseline system.

Question 37

6.4 Automation
It’s common to combine imaging with other automated methods for baselines. In other words, administrators can create one image for all desktop computers within an organization. They then use automated methods to add additional applications, features, or settings for specific groups of computers (Microsoft’s Group Policy).

Question 38

7. Managing Change
   Deploying systems in a secure state is a good start. However, it’s also essential to ensure that systems retain that same level of security. The primary goal of change management is to ensure that changes do not cause outages.
   Change management helps ensure that an organization takes the time to evaluate the risk of weakening security and compare it to the benefits of increased usability.

Question 39

7.1 Change Management
Change management controls provide a process to control, document, track, and audit all system changes. This includes changes to any aspect of a system, including hardware and software configuration. Organizations implement change management processes through the lifecycle of any system.

Common tasks within a change management process are as follows:
- Request the change.
- Review the change.
- Approve/reject the change.
- Test the change.
- Schedule and implement the change.
- Document the change.

Question 40

7.2 Versioning
Versioning typically refers to version control used in software configuration management. A labeling or numbering system differentiates between different software sets and configurations across multiple machines or at different points in time on a single machine.

Question 41

7.3 Configuration Documentation
Configuration documentation identifies the current configuration of systems. It identifies who is responsible for the system and its purpose and lists all changes applied to the baseline.

Question 42

8. Managing Patches and Reducing Vulnerabilities
   Patch and vulnerability management processes work together to help protect an organization against emerging threats.

Question 43

8.1 Systems to Manage
We should manage not only workstations and servers, but also:
- any computing device with an operating system: routers, switches, firewalls, appliances (such as a unified threat management appliance), and printers all include some type of operating system;
- Embedded systems (IoT, camera systems, smart televisions, household appliances, medical devices);
- mobile devices (such as smartphones and tablets). MDM.

Question 44

8.2 Patch Management
A patch is a blanket term for any type of code written to correct a bug or vulnerability or to improve existing software performance.
An effective patch management program ensures that systems are kept up to date with current patches. These are the common steps within an effective patch management program:
- Evaluate patches.
- Test patches.
- Approve the patches.
- Deploy the patches.
- Verify that patches are deployed.

Question 45

8.3 Vulnerability Management
Vulnerability management refers to regularly identifying vulnerabilities, evaluating them, and taking steps to mitigate risks associated with them.

Question 46

8.4 Vulnerability Scans
Vulnerability scanners are software tools used to test systems and networks for known security issues. A vulnerability scan enumerates (or lists) all the vulnerabilities in a system. Attackers use vulnerability scanners to detect weaknesses in systems and networks, such as missing patches or weak passwords.

Question 47

8.5 Common Vulnerabilities and Exposures
Vulnerabilities are commonly referred to using the Common Vulnerability and Exposures (CVE) dictionary. The CVE dictionary provides a standard convention used to identify and describe vulnerabilities. MITRE maintains the CVE database, and you can view it here: cve.mitre.org.

none
MITRE looks like an acronym, but it isn’t. The founders do have a history as research engineers at the Massachusetts Institute of Technology (MIT) and the name reminds people of that history. However, MITRE is not a part of MIT. MITRE receives funding from the U.S. government to maintain the CVE database.

Patch management and vulnerability management tools commonly use the CVE dictionary as a standard when scanning for specific vulnerabilities. As an example, CVE-2020-0601 identifies a vulnerability in the Windows CryptoAPI (Crypt32.dll). Microsoft patched this vulnerability in the January 2020 security update.