CC · Domain 5
Security Operations
About 18% of the exam
The three data states
- At rest
- stored on a disk
- In transit
- moving across a network
- In use
- open in memory
- Protect at rest
- full disk or file encryption
- Protect in transit
- TLS or a VPN tunnel
- Protect in use
- restrict access, lock the screen
Encryption and hashing
- Symmetric
- one shared key, fast
- Asymmetric
- a public and private pair
- Hash
- one way fingerprint of data
- Salt
- random value defeating rainbow tables
- Digital signature
- signed with the sender private key
- Certificate
- binds a key to an identity
- Key management
- generate, store, rotate, retire
Encryption is reversible with the key and protects secrecy; hashing is one way and only proves nothing changed
The data lifecycle
- Create
- Store
- Use
- Share
- Archive
- Destroy
- Classify at the moment of creation
- Label so the handling rules show
- Archive is offline but retrievable
- Destroy at the end of retention
- Retention comes from law and need
Classification and labeling
- Public
- no harm if disclosed
- Internal
- routine business information
- Confidential
- real harm if leaked
- Restricted
- the most sensitive commercial tier
- Government tiers
- confidential, secret, top secret
- Labeling
- marks the level on it
- Data owner
- sets the classification
- Data custodian
- applies the protection
Sanitization and destruction
Clear
- Overwrite using normal write commands
- For media reused inside the organization
- Blocks recovery with ordinary tools
Purge
- Cryptographic erase or degaussing
- For media leaving your control
- Laboratory recovery becomes infeasible
Destroy
- Shred, pulverize, melt or incinerate
- For the most sensitive media
- Obtain a certificate of destruction
- Degaussing only ruins magnetic media
Deleting a file or quick formatting a disk removes the pointer and not the data, so neither counts as sanitization
Logging and monitoring
Sources
- Operating system security logs
- Firewall allow and deny records
- Application and database logs
- Badge reader entry records
- Endpoint and antivirus alerts
What to look for
- Repeated failures then a success
- Logins at unusual hours
- Large transfers out of hours
- New administrator accounts appearing
- Logs that suddenly stop arriving
How to handle logs
- Send them to a central store
- Protect them from tampering
- Synchronize clocks across systems
- Retain for the required period
- Someone has to read them
Configuration management
- Inventory every device and application
- Define a secure baseline
- Deploy from an approved image
- Disable unused services and accounts
- Detect drift from the baseline
- Document every approved change
Patching and change
- Patch
- fixes one specific flaw
- Update
- adds fixes and features
- Test first
- somewhere that mirrors production
- Emergency change
- still approved, just afterwards
- Rollback plan
- how to undo it
- Change board
- reviews and approves changes
- End of life
- no patches will ever come
Policies to know
- Acceptable use
- how staff may use resources
- Data handling
- storing, sharing and destroying data
- Password policy
- length, reuse and lockout
- BYOD policy
- personal devices, company data
- Change management
- how changes get approved
- Privacy policy
- how personal data is treated
- Clean desk
- nothing sensitive left visible
Security awareness training
- Training at hire and yearly
- Simulations that teach rather than punish
- Report suspicious messages, never just delete
- Never plug in unknown media
- Verify unusual requests out of band
- Lock the screen when leaving
- Keep work data off personal accounts
Physical operations
- Escort and log every visitor
- Keep server rooms locked and cool
- Test fire suppression on schedule
- Shred printed output, never bin it
- Cable locks for shared laptops
- Recheck camera coverage after changes
Daily operational habits
- Least privilege for daily accounts
- A separate account for administration
- Back up, then test the restore
- Encrypt anything leaving the building
- Ask before sharing data externally
- Follow the procedure, then improve it
Rapid recall
- Hashing
- detects change, needs no key
- Encryption
- protects secrecy, needs a key
- Baseline
- the approved configuration
- Drift
- quietly moving off baseline
- Retention
- how long you keep it
- Sanitization
- clear, purge, destroy
- Least privilege
- only what the job needs
Know the order
- Data lifecycle
- create, store, use, share, archive, destroy
- Sanitization
- clear, then purge, then destroy
- Change
- request, test, approve, deploy, document
- Logs
- collect, protect, review, retain
- Training
- at hire, then every year
Reference strip: data, logs, configuration, people
Data protection
- At rest, in transit, in use
- Symmetric, asymmetric, hashing, salting
- Certificates and key management
- Classification, labeling, handling rules
Disposal
- Clear, purge, destroy
- Degauss, shred, pulverize, incinerate
- Certificate of destruction
- Retention schedules and legal hold
Monitoring
- Central log collection and time sync
- SIEM correlation and alerting
- Physical access and camera records
- Someone reviews, not just collects
Configuration
- Inventory, baseline, approved image
- Patch testing and rollback plans
- Change board and documentation
- Drift detection and end of life
People
- Acceptable use and BYOD policies
- Awareness training and simulations
- Clean desk and screen locking
- Reporting rather than deleting
Quick exam traps
- Trap: Deleting a file removes the data from the disk
- Trap: Collecting logs is the same as monitoring them
- Trap: Hashing keeps the contents of a file secret
- Trap: Emergency changes need no approval at all
- Trap: Degaussing works on solid state drives
- Trap: Awareness training only matters for technical staff
- Trap: A baseline set once will hold without checking
cybercertprep.com · original revision sheet written from the public body of knowledge