(Objective 1.1) Professional Ethics
Organizational Code of Ethics
Professional Ethics
(ISC)2 Code of Ethics
Canon I: Protect society, the common good, necessary public trust and
confidence, and the infrastructure.
Canon II: Act honorably, honestly, justly, responsibly, and legally
Canon III: Provide diligent and competent service to principals
Canon IV: Advance and protect the profession.
(Objective 1.2) Fundamental Security Concepts
CIA Triad
Condidentiality
Related Terms: Secrecy | Sensitivity | Concealment | Discretion | Privacy | Seclusion | Obfuscation
Common Threats
Inappropriate Access controls
Brute force, dictionary attacks
Cryptographic key mis-management
Errors and ignorance from employees
Common Controls
Strong Access Controls (need to know)
Strong cryptography and protocols
Integrity
Related Terms
Accuracy | Authenticity | Completeness
Threats
Hardware failure, software bugs, or human errors / corruption of data
Tempering of data or systems to prevent detection
Malware deleting data on the system
Unreliable data ingested in useful information
MitM leading to modification of data
Common Controls
Configuration Management and FIM
Availability
Related Terms
usability (disruption) | Accessibility | Timeliness
Common Threats
Cyberattacks (DDoS, ransomware, hacking, software bugs, data breaches etc.)
Common Controls
Redundancy (Clusters, RAID, Cloud, Multiple vendors, redundant power and internet lines etc)
Strong access controls to prevent unauthorized access by malicious actors
(Objective 1.3) Security Governance
(Objective 1.4) Determine Compliance Requirements
(Objective 1.5) Legal and Regulatory Requirements
(Objective 1.6) Investigation Requirements
(Objective 1.7) Security Polices, Standards, Procedures and Guidelines
(Objective 1.8) Business Contineuity Requirements
(Objective 1.9) Personnel Security Polices and Procedures
(Objective 1.10) Risk Management
(Objective 1.11) Threat Modelling
(Objective 1.12) Supply Chain Risk Management
(Objective 1.13) Security Awareness, Education & Training