Overview
Security and Risk Management in this Domain 1 of the (ISC)2® CBK lays the foundation for the entire course, introducing concepts and principles that will be utilized throughout. It is imperative that the candidate learn and understand these thoroughly, if the candidate is not already familiar with the material from professional practice.
NOTE: Throughout this domain and much of the rest of the course material, the term “organization” will be used to describe operational entities; an organization might be a private business operating in a market dynamic, a government entity, or a nonprofit/charitable agency of some kind. This term is used in generic fashion as a consideration that candidates may work for any type of functional unit; the material is designed to be agnostic to the type of industry or nature of work a particular unit might be involved in. When material is specific to a certain type of organization, it will be specified in context (for instance, a bank as a financial organization has specific security concerns not faced by other types of organizations).
Domain Objectives
After completing this domain, the participant will be able to:
- Explain the concepts of confidentiality, integrity, and availability.
- Differentiate between confidentiality, integrity, and availability.
- Recognize security governance principles.
- Describe how the security function of an organization aligns to that organization’s business strategy, goals, mission, and objectives.
- Describe various typical roles and responsibilities related to security within oragnizations.
- Identify governance processes within organizations, and explain how those may affect security.
- Identify specific security control frameworks based on a brief description or list of framework attributes.
challenges/benefits associated with each. - Discern between the concepts and meaning of “due care” and “due.
- Describe common practices used for asset valuation and the challenges/benefits associated with each.
- Distinguish between threats and vulnerabilities.
- Identify common practices of risk assessment and analysis.
- Know the four common methods of security risk management.
- Know how to choose from the four common methods of risk management.
- Recognize common practices for selecting security controls.
- List the various types, classes, and categories of security controls.
- Describe the importance of monitoring and measuring the security program and controls and why this is performed on a continuous basis.
- Recognize common risk frameworks.
- Apply risk-based management concepts to the supply chain and the use of third parties for risk assessment and monitoring.
- Recognize standard threat modeling concepts.
- Apply threat modeling methodologies.
- Recognize common threats and risks.
- Recognize the purpose of the service level agreement, how it augments the contract, and which items should be contained in each.
- Determine and document minimum security requirement.
- Recognize the various forms of compliance requirements (laws/regulations, standards, and contracts).
- Understand the concept of regulatory compliance, especially in the context of modern privacy requirements, and identify typical regulations encountered in practice.
- Recognize the role of digital rights management (DRM) solutions in protecting intellectual property.
- Recognize modern international legal restrictions on import/ export of data and IT tools.
- Identify common privacy terms used in current personal data protection laws worldwide.
- Describe the hierarchy of written governance (policies, standards, guidelines, and processes).
- Identify the various means to support personnel security goals, including common policies and procedures.
- Explain how modern legal frameworks affect international data flow and how the information security industry is responsible for many compliance requirements.
- Describe the importance of security training, education, and awareness and how to differentiate between those elements.
- Describe the necessity of business continuity and disaster recovery (BCDR) functions, and recognize basic foundational concepts.
- Explain the ethical standards to which a professional security practitioner will be expected to uphold, as well as the standards of behavior and performance expected of (ISC)2 members.
