Congratulations.
You've completed the Security Principles Domain for the
Certified in Cybersecurity course.
Let's do a quick summary of the important things we covered in this domain.
This domain was divided into four sections,
information security concepts and governance,
risk management, security controls, and the ISC squared code of ethics.
The first part we looked at, a very important foundational part,
was information security concepts and governance,
and here we looked at some key points.
First of all,
the security should not be an add‑on or an option or something
we tried to put on top of a business process,
but instead,
it should be something built into and integrated with the business process.
The security strategy should be aligned with to support
business operations and strategy as well.
We should do our work in a secure way.
We also know that it's important to have oversight for the security program,
and organizational governance and oversight requires management to personally
own and be accountable for the security program as well.
For many years, we've defined security using this idea of the CIA triad.
This was a way to make security understandable and have
a clear definition for everybody.
So we use terms like confidentiality,
dealing with things like secrecy and privacy,
integrity, the accuracy of both processing and of the data itself,
and availability,
making sure that our systems and our data are
available for use when they're required.
One of the things that the foundation for a security
program is the idea of risk management.
Risk is something that is a natural part of business.
We do not seek to eliminate risk, instead we seek to manage risk,
but this means that risk must be owned.
There must be somebody who is responsible for,
first of all, identifying that risk,
selecting and approving some type of risk treatment or risk response,
and for monitoring for changes in the risk conditions.
In the end, we want to ensure that all of the risk we face is acceptable,
and we call this the risk acceptance level.
It can only be determined by the person who owns the
risk, which must be a senior manager.
The goal of our risk management program is to ensure that all
of our risk is now at an acceptable level.
That means that the residual risk has been reduced to an area that
either is equal to or less than risk acceptance.
Residual risk as we remember is the level of risk that remains
once the controls have been implemented.
When we talk about controls,
we're talking about a number of important things here.
A control is something that's put in place to address a risk.
It's the risk that justifies that control,
and therefore, the control is there to try to mitigate or reduce that risk.
We have two main types of controls, proactive controls,
such as safeguards to try to make sure that bad things don't happen,
and countermeasures,
reactive controls that kick in once something bad has happened.
We looked at three different types of controls,
administrative, or sometimes called managerial controls such as a policy,
technical, or sometimes called logical controls like a firewall,
and physical and environmental controls,
things like access control and power, for example.
Then we looked at the ISC squared code of ethics.
As certification holders, we are bound by this professional code of ethics.
It is mandated for all certification holders and guides our behaviors,
and failure to abide by the code of ethics could result in
some type of a disciplinary activity as enforced by the
board of directors of ISC squared.
The next steps.
We've completed the first domain,
the foundational and the most important domain from an exam perspective,
but now we need to move on.
That means we should review and make sure we've understood what we've covered.
We should seek to have an understanding of the concept,
not just memorization of the topic.
Do the sample questions to ensure we have the correct
understanding as listed in the study guide,
and then proceed to the next domain, Business Continuity,
Disaster Recovery, and Incident Response.