SSCP · Domain 1
Security Concepts and Practices
About 16% of the exam
Core concepts
- Confidentiality
- disclosure only to the authorized
- Integrity
- accurate and provably unaltered
- Availability
- usable when the business needs it
- Privacy
- control over personal information
- Non-repudiation
- the actor cannot deny it
- Least privilege
- only the rights the job needs
- Defense in depth
- layers, no single decisive failure
- Trust but verify
- check what you have permitted
The code of ethics
- Protect society and infrastructure
- Act honorably and legally
- Serve principals diligently
- Advance the profession
- Canons apply in the order shown
- Society outranks the employer
- Refuse and report unethical instructions
- A breach can cost the certification
Control categories
- Technical
- enforced by hardware or software
- Physical
- locks, barriers, guards, cameras
- Administrative
- policy, procedure, training, screening
- Owner
- accountable for the control working
- Operator
- runs it day to day
- Assessor
- tests it independently
Control functions
- Deterrent
- discourages the attempt
- Preventive
- stops the action
- Detective
- reveals that it happened
- Corrective
- restores the correct state
- Compensating
- covers a control you cannot use
- Directive
- instructs the required behavior
One device can carry several functions: a monitored camera deters, detects and provides corrective evidence
Asset management lifecycle
Acquire and inventory
- Procure through an approved process
- Record hardware, software and data
- Track licenses against installations
- Discovery finds what inventory missed
Classify and own
- Owner sets the classification
- Custodian applies the controls
- Labeling makes handling rules visible
- Categorize by impact if lost
Sanitize and dispose
- Clear for internal reuse
- Purge before the media leaves
- Destroy the most sensitive media
- Keep the certificate of destruction
- Remove the asset from inventory
You cannot protect, patch or decommission what is not in the inventory, which is why asset management underpins everything else
Physical security operations
Perimeter
- Fencing, bollards and lighting
- Gatehouse and vehicle checks
- Cameras with recorded retention
- Signage as a deterrent control
Interior
- Badging with photo and expiry
- Access control vestibule at sensitive doors
- Visitor escort and logged entry
- Secure areas keyed separately
- Clean desk and screen locking
Environmental
- Redundant power and generators
- UPS covering the transfer gap
- HVAC for temperature and humidity
- Fire detection and suppression
- Water and leak detection
Documenting controls
- Record what the control protects
- Record who owns and operates it
- State how it is tested
- Keep configuration under version control
- Log every approved change
- Review documentation on a cycle
Assessment and audit
- Self-assessment
- the team checks itself
- Internal audit
- independent of the operating team
- External audit
- third party opinion for others
- Control design
- would it work if operated
- Operating effectiveness
- did it actually work
- Finding
- gap with an owner and date
- Evidence
- proof collected as you go
Awareness and training
- Awareness changes habits, training builds skill
- Deliver at hire and annually
- Role specific content for privileged staff
- Simulations that coach, not shame
- Measure reporting as well as clicks
- Refresh after any significant incident
Data classification and handling
- Public
- no harm from disclosure
- Internal
- routine business material
- Confidential
- damage if disclosed
- Restricted
- severe damage if disclosed
- Handling rules
- storage, transfer and disposal per level
- Retention
- law and business need decide
- Legal hold
- overrides the retention schedule
Duties and privilege
- Segregate duties on critical processes
- Nobody approves their own request
- Rotate duties to expose collusion
- Mandatory vacation surfaces hidden activity
- Dual control for high value actions
- Review privileged accounts frequently
Zero trust in practice
- Authenticate every request, every time
- Location no longer implies trust
- Check device posture as well
- Authorize per resource, not per network
- Log the decision for later review
- Segment so failures stay local
Rapid recall
- Policy
- intent, mandatory, high level
- Standard
- the mandatory specifics
- Procedure
- ordered steps to follow
- Guideline
- advice, not compulsory
- Baseline
- minimum accepted configuration
- Owner
- accountable, sets classification
- Custodian
- implements and maintains protection
Know the order
- Ethics canons
- society, honor, principals, profession
- Asset lifecycle
- acquire, inventory, classify, maintain, dispose
- Sanitization
- clear, purge, destroy
- Control test
- design first, effectiveness second
- Training
- at hire, then annually
Reference strip: concepts, controls, assets, people
Concepts
- CIA, privacy, non-repudiation
- Least privilege and need to know
- Defense in depth and segmentation
- Zero trust, trust but verify
Controls
- Technical, physical, administrative
- Deterrent, preventive, detective
- Corrective, compensating, directive
- Ownership, testing, documentation
Assets
- Hardware, software and data inventory
- Licensing and configuration records
- Classification, labeling, handling
- Sanitization and certified destruction
Physical
- Badging, vestibules, visitor escort
- Cameras, guards, secure areas
- Power, cooling, fire suppression
- Environmental monitoring and alarms
People
- Code of ethics and its order
- Awareness versus training
- Segregation of duties and rotation
- Background screening and agreements
Quick exam traps
- Trap: A compensating control is a weaker version of the same control
- Trap: Awareness and training mean the same activity
- Trap: The custodian decides the classification of the data
- Trap: An asset not in the inventory is not your problem
- Trap: Physical security sits outside the security practitioner role
- Trap: Testing a control design proves it operates effectively
- Trap: Zero trust removes the need for network segmentation
cybercertprep.com · original revision sheet written from the public body of knowledge