CISSP Cheat Sheet

This cheat sheet summarizes notes from CISSPs gathered from various sources to highlight the key principles of the CISSP mindset.

CISSP Exam Mindset

• Human life is always #1 priority.
• Your role is a risk advisor, CISO, or Senior Management.
• Do NOT fix problems.
• Fix the process, not the problem.
• Who is responsible for security?
• How much security is enough?
• All decisions start with risk management. Risk Management starts with identifying/valuating your assets.
• Always think about the overall risk and remediation steps for each technology, tools, components or solution.
• Security should be “baked in”, rather than “bolted on”.
• Layered defense!
• People are your weakest link.
• Think security? Think about CIA.
• Behave ethically.
• All controls must be cost justified (safeguards)
• Senior management must drive the security program (business proposal, positive ROI).

Exam Tip

Domain 1: Security and Risk Management

• To maintain confidentiality, you should always encrypt data. {In Motion - TLS} {At rest - AES - 256}
• Primary goal of risk management is to reduce the risk to an acceptable level
• Human safety is your first priority. Data is second

---

Domain 2: Asset Security

---

Domain 3: Security Architecture and Engineering

• When used properly, they are unbreakable
• Key length directly relates to work function of cryptosystem
• Key management is essential part
• Each key should be changed periodically
• Key length is perhaps the most important security parameter. Key length determines the amount of time taken to break the algorithm. Considering computing powers changes, it is advisable to keep on changing the key length
• Simple ---> Read; Star ---> Write
• Whenever change happens, system needs to be recertified again.
• Threat to storage media ----> Data Remanence
• Primary focus of OS is to keep the computing environment stable and keep process isolated from each other
• Within organization, area should be compartmentalized or separated based on the sensitivity

---

Domain 4: Communication and Network Security

• Most of the protocols which starts with “I” is a layer 3 protocol. IP, ICMP, IGMP, IGRP, IPSeC, IKE, ISAKMP. IMAP being an exception as it works at layer 7
• Asymmetric Digital Subscriber Line (ADSL) faster than ISDN
• The b, g, and n amendments all use the same frequency; thus, they maintain backward compatibility.
• There are no attacks against PAP as everything is in cleartext.
• Spamming, mail bombing are some common issues which are hard to stop as addresses are spoofed.
• POTS/PSTN can be used as back up of broadband failure
• Scalability, quick recovery are few advantages of virtualization. However, threats like malicious codes which compromise virtual OS are also there

---

Domain 5: Identity and Access Management (IAM)

• Type 2 Error is FAR from Type 1 error
• For Biometric Authentication, ENROLLMENT must take place first. Enrollment time over 2 mins is unacceptable
• Think about booking a flight for your holidays and you get an option to book hotel on the same site. The moment you login to hotel site, it won’t ask for your credentials again as the site for flight booking and hotel booking are under Federated Domain
• SAML is for enterprise use and OAuth is for commercial use (by us)
• Implicit deny should be a default configuration for any component
• TLS 1.2 is a technique to encrypt data in transit

---

Domain 6: Security Assessment and Testing

---

Domain 7: Security Operations

• Least Privilege and SoD helps in prevent violation. Monitor helps in Deter or detect violation
• Any unauthorized change in the system impacts Availability of CIA triad
• it's important to remember the above sequence of steps: Request Change -> Review the change -> Approve/Reject -> Test -> Schedule for implementation -> Document
• It is best to be familiar with the sequence of incident response
• Logs and reports should be preserved. One way is to access remotely
• For zero downtime, redundant failover systems are required
• Hardware disks are more reliable & expensive
• Always make sure your off site is at an optimum distance so that any disaster should not affect both the sites.
• A disaster plan should contain a call tree (list of the people to be contacted) handy. Once the disaster team reaches at site, first task is to assess the situation.
• Back up should be done during low peak time. You should always test the restoration of the backups to avoid last minute surprises.
• Disaster Recovery plan should be classified as extremely sensitive document. Should have only one copy.
• Best method is to work on the copy of the evidence
• Never hack back the attacker
• All evidence must be secured. Remote login to preserve any evidence. Incidents should be properly reported and documented.

---

Domain 8: Software Development Security

• Expert Systems are as good as the data in the Knowledge Base.

Reference:

[1] The Memory Palace by Prashant Mohan