SSCP: A High-Speed Introduction to the Exam Domains Intro to IT Security Access Controls Administration Auditing and Monitoring Risk, Response, and Recovery Cryptography Data Communications Malicious Code / Malware Testing Tips Domain 4 William F. Slater, III IT Consultant – Author – Teacher – Mentor SSCP, CISSP, MCSE, Security+ slater@billslater.com

Agenda Domain Definition Risk Response Recovery Conclusion

Domain Definition

What Is Risk?

Major System Elements At Risk

Major System Elements At Risk

Major System Elements At Risk

Major System Elements At Risk

Threats

Vulnerability Any weakness in a system that can be exploited R = V x T Risk = Vulnerability x Threat

Controls

Safeguards Controls that are put into place to provide some amount of protection to an asset.

Countermeasures

Exposure The amount or percentage of loss experienced should a threat exploit a vulnerability. Don’t forget things like the exposure of a company’s reputation and/or the brand.

Risk Analysis

Risk Assessment Loss of Confidentiality Loss of Integrity Loss of Availability

Threats vs. Vulnerabilities Threats exist and typically don’t change or change much over time Vulnerabilities are places where your IT assets are already weak.

Analyzing Risk

Quantitative Risk Analysis

Quantitative Risk Analysis

Quantitative Risk Analysis

Quantitative Risk Analysis

Qualitative Risk Analysis

Automated Risk Assessment Automated Risk Analysis Tools have become quite popular and are big time savers.

Automated Risk Assessment

Risk Management Process of identifying, measuring, and controlling uncertain events.

An Effective Risk-Assessment Methodology Taken from NIST’s website Risk = Threat x Vulnerability R = T x V

An Effective Risk-Assessment Methodology

An Effective Risk-Assessment Methodology

Response Those activities performed when a security-related incident occurs

Response Tools

Response Tools

Relationship of Incident Response to Incident Response to Contingency Planning

Incident Response Determining Which Protocol to Use:

Recovery

Restoration and Recovery

Conclusion Risk Management is essential to understanding to creating the right kind of BCP and DRP for an organization. Understanding Risk Management and creating a corresponding BCP and DRP is a likely place that SSCPs and CISSPs would be involved.

Questions and Answers

References & Text Resources Corrigan, P. H. (1994). LAN Disaster Prevention and Recovery. Englewood Cliffs, NJ: Prentice Hall. Isaac, D. S. and Isaac, M. J. (2003). The SSCP Prep Guide. Indianapolis, IN: Wiley Publishing. Hansche, S., Berti, J. and Hare, C. (2004). Official (ISC)2 Guide to the CISSP Exam. Boca Raton, FL: Auerbach Publications. Harris, S. (2003). All-In-One CISSP Certification Exam Guide, second edition. Emeryville, CA: Osborne McGraw-Hill. Middleton, B. (2005). Cyber Crime Investigator’s Field Guide, second edition. Auerbach Publications: Boca Raton, FL. Pfleeger, C. P. and Pfleeger, S. L. (2003). Security in Computing, Third Edition. Upper Saddle River, NJ: Prentice Hall. Sandhu, R. J. (2002). Disaster Recovery Planning Crash Dump. Boston: Premier Press. Toigo, J. W. (2003). Disaster Recovery Planning: Preparing for the Unthinkable. Upper Saddle River, NJ: Prentice Hall. Wallace, M. and Webber, L. (2004) Disaster Recovery Handbook, The: A Step-by-Step Plan to Ensure Business Continuity and Protect Vital Operations, Facilities, and Assets. New York: AMACOM. Wold, G. and Shriver, R. (1998). Disaster Proof Your Business, University of Phoenix Edition. New York: McGraw-Hill Companies, Inc.