1. Chapter 1: Security Governance Through Principles and Policies

2. Understand and Apply Concepts of Confidentiality, Integrity, and Availability
CIA Triad
AAA services
Protection mechanisms

3. CIA Triad
Confidentiality
Integrity
Availability C I A

4. Confidentiality Sensitivity Discretion Critical Concealment Secrecy
Privacy
Seclusion
Isolation

5. AAA Services Identification Authentication Authorization Auditing
Accountability
Nonrepudiation

6. Protection Mechanisms
Layering
Abstraction
Data hiding
Encryption

7. Apply Security Governance Principles
Alignment of security function to strategy, goals, mission, and objectives
Organizational processes
Security roles and responsibilities
Control frameworks
Due care and due diligence

8. Alignment of Security Function
Alignment to strategy, goals, mission, and objectives
Security policy
Top-down approach
Senior management approval
Plans: strategic, tactical, operational

9. Organizational Processes
Security governance
Acquisitions and divestitures
Change control/management
Data classification
Government/military vs. commercial/private sector

10. Security Roles and Responsibilities
Senior manager
Security professional
Data owner
Data custodian
User
Auditor

11. Control Frameworks
COBIT
ISACA
OSSTMM
ISO/IEC 27002
ITIL
NIST

12. Develop and Implement Documented Security Policy, Standards, Procedures, and Guidelines
Security policies
Security standards, baselines, and guidelines
Security procedures

13. Understand and Apply Threat Modeling
Identifying threats
Determining and diagramming potential attacks
Performing reduction analysis
Prioritization and response

14. Identifying Threats Focused on assets Focused on attackers
Focused on software
STRIDE
Spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege

15. Determining and Diagramming Potential Attacks
Diagram the infrastructure
Identify data flow
Identify privilege boundaries
Identify attacks for each diagrammed element

16. Performing Reduction Analysis
Trust boundaries
Data flow paths
Input points
Privileged operations
Details about security stance and approach

17. Prioritization and Response
Probability × damage potential ranking
High/medium/low rating
DREAD system
Damage potential
Reproducibility
Exploitability
Affected users
Discoverability

18. Integrate Security Risk Considerations into Acquisition Strategy and Practice
Resilient integrated security
Cost of ownership
Outsourcing
Integrated security assessments
Monitoring and management
Onsite assessment
Document exchange and review
Process/policy review