ITIS-468-47605: Certified Information Systems Security Professional (CISSP) Cert Exam Prep

The CIA Triad

Every control in the CISSP body of knowledge exists to protect one or more of three properties: confidentiality, integrity, and availability. Confidentiality means information is disclosed only to authorized parties. Integrity means information and systems are accurate and unaltered by unauthorized actors. Availability means authorized users can reach resources reliably when they need them.

• Confidentiality — encryption, access control, need-to-know, classification.
• Integrity — hashing, digital signatures, change control, separation of duties.
• Availability — redundancy, fault tolerance, backups, capacity planning, DDoS defense.
• Supporting goals: authenticity, non-repudiation, and accountability through auditing.

Governance: policies, standards, procedures, guidelines

Security governance is the set of management structures that make security intentional rather than accidental. It flows top-down from senior management, because only senior management can accept residual risk on behalf of the organization.

• Policy — high-level management intent. Broad, mandatory, rarely changes.
• Standard — mandatory, specific. 'All laptops use full-disk encryption.'
• Baseline — the minimum acceptable configuration level.
• Procedure — mandatory step-by-step instructions to accomplish a task.
• Guideline — recommended, discretionary advice where flexibility is needed.