Site icon TheCyberThrone

CISSP Domain 7 Security Operations Detailed Notes Part I

PravinKarthik
Advertisements

🧭 Purpose

Domain 7 focuses on establishing, managing, and operating day-to-day security functions. This includes monitoring systems, responding to incidents, supporting investigations, and ensuring the continued confidentiality, integrity, and availability (CIA) of information assets.

It’s the most hands-on, operations-focused domain of the CISSP—translating policy into active protection.

Considering the length and depth of this domain, i have made the notes in to two parts. This is the Part I.

📌 Key Concept Areas

7.1 – Understand and Comply with Investigations

🔍 1. Evidence Collection and Handling

🔐 Chain of Custody

⚖️ Legal Considerations

🧠 Best Practices

📌 Example: During a breach investigation, memory is dumped, disk images are captured, and each is hashed and signed into an evidence logbook.

📑 2. Reporting and Documentation

✍️ Purpose

🔖 Report Elements

✅ Key Principles

📌 Example: After a ransomware attack, the IR team logs timestamps of alerts, evidence gathered, the impact scope, and steps taken in a post-incident report.

🕵️ 3. Investigative Techniques

🔍 Common Techniques

🔀 Structured Approach

📌 Example: An organization notices a user account performing file transfers at odd hours. The analyst reviews VPN, file access, and system logs to determine potential insider exfiltration.

🛠️ 4. Digital Forensics Tools, Tactics, and Procedures

🧰 Key Tools

Tool Use Case EnCase, FTK Full disk imaging & analysis Autopsy GUI-based forensic timelines Volatility Memory analysis Wireshark Network packet capture analysis Cellebrite Mobile device forensics

⚙️ Tactics

📌 Example: A malware investigation uses FTK for full disk imaging and Volatility to find traces of in-memory payloads not written to disk.

📦 5. Artifacts

📂 Artifact Types

Artifact Source Examples Data Files Documents, emails, logs Operating System Registry keys, event logs, prefetch files Network Devices Firewall logs, NetFlow data, PCAPs Mobile Devices GPS logs, call history, text messages Cloud/SaaS Access logs, API activity, authentication events

🎯 Why Artifacts Matter

📌 Example: A user claims not to have downloaded a sensitive file. Analysis of system logs, browser history, and USB activity proves otherwise.

✅ Summary

7.2 – Conduct Logging and Monitoring Activities

🔹 Intrusion Detection and Prevention Systems (IDPS)

📘 Example: A NIPS device identifies and blocks an SQL injection attack targeting a customer-facing web application.

🔹 Security Information and Event Management (SIEM)

📘 Example: SIEM correlates multiple failed logins and unusual data access to trigger a brute-force attack alert.

🔹 Continuous Monitoring and Tuning

📘 Example: After SIEM generates excessive alerts on a backup server, tuning is applied to recognize and filter normal operations.

🔹 Egress Monitoring

📘 Example: A DLP system blocks an email containing PII from being sent to a personal Gmail account.

🔹 Log Management

📘 Example: Logs from a critical database are forwarded to a secure log server and retained for 13 months to meet audit requirements.

🔹 Threat Intelligence

📘 Example: Threat feeds provide IOC data (e.g., IPs) that is integrated into the SIEM for proactive alerting.

🔹 User and Entity Behavior Analytics (UEBA)

📘 Example: UEBA flags a privileged user accessing sensitive files outside normal work hours and from a foreign IP address.

🧠 Summary

7.3 – Perform Configuration Management (CM)

🔹 1. Provisioning

✅ Definition

Provisioning refers to the process of preparing and equipping systems, devices, applications, and users with the appropriate configurations, access rights, and resources.

🔐 Security Considerations

🧰 Tools

🌍 Real-World Example

When a new developer joins, their laptop is provisioned with encrypted storage, VPN access, and read-only access to code repositories—automated through MDM and provisioning scripts.

🔹 2. Baselining

✅ Definition

Baselining is the process of establishing a known and trusted configuration standard for systems and comparing future states against this baseline.

🎯 Goals

📋 Types of Baselines

📌 Implementation

🌍 Real-World Example

An organization maintains a baseline for all production servers, including firewall rules, installed packages, and user groups. Any unauthorized change (e.g., new service installed) triggers an alert.

🔹 3. Automation

✅ Definition

Automation in CM involves using tools and scripts to manage provisioning, configuration drift correction, updates, and compliance monitoring.

🚀 Benefits

🔁 Use Cases

🧰 Common Tools

🌍 Real-World Example

If a production server opens port 23 (Telnet) due to a misconfigured deployment script, automation instantly closes the port and sends an alert to the security team.

🔹 4. Change Control and Change Management

✅ Definition

Structured process that governs how changes to configurations are requested, evaluated, approved, and implemented.

🛠️ Key Components

  1. Change Request: Formal submission to modify systems
  2. Impact Analysis: Understand risks to availability, security, etc.
  3. Change Advisory Board (CAB): Group that approves/rejects changes
  4. Implementation Plan: Testing, scheduling, rollback steps
  5. Post-Implementation Review: Ensure no negative impact

🔐 Security Implications

🌍 Real-World Example

Before upgrading the database version, the request goes through CAB. A test is performed in the staging environment and once approved, scheduled during low-traffic hours with rollback procedures in place.

🧠 Summary

7.4 – Apply Foundational Security Operations Concepts

This section emphasizes core principles that secure day-to-day IT operations and ensure that access, roles, and responsibilities are clearly defined, monitored, and limited to prevent abuse or error.

🔹 1. Need-to-Know & Least Privilege

✅ Definition:

🔐 Security Objectives:

🛠 Implementation Techniques:

🌍 Real-World Example:

A payroll clerk can only view and process payroll data, but cannot access or modify tax tables or employee benefit plans—those tasks are assigned to HR administrators.

🔹 2. Separation of Duties (SoD) and Responsibilities

✅ Definition:

The concept of splitting tasks and privileges among multiple people to prevent fraud, errors, and collusion.

🎯 Goals:

🧩 Examples of SoD in Practice:

🌍 Real-World Example:

In a bank, a teller who processes cash transactions cannot also reconcile the vault at the end of the day—this reduces fraud risk.

🔹 3. Privileged Account Management (PAM)

✅ What It Is:

The secure handling, control, and monitoring of privileged or administrative accounts, which have access to sensitive systems or critical controls.

🔒 Key Elements:

🚨 Risks Without PAM:

🌍 Real-World Example:

An IT admin accesses a production server through a PAM system that records their session, limits their privileges to read-only, and automatically revokes access after 30 minutes.

🔹 4. Job Rotation

✅ Definition:

Systematic shifting of personnel between roles to ensure no one becomes irreplaceable or unaccountable in critical areas.

🎯 Objectives:

🧪 Security Benefit:

Unusual or improper behavior may be revealed when someone new steps into a role.

🌍 Real-World Example:

A network administrator is rotated every 6 months. During the transition, the new admin discovers unauthorized firewall rules added during the predecessor’s tenure.

🔹 5. Service-Level Agreements (SLA)

✅ Definition:

A contractual agreement between a service provider and a customer that defines performance metrics, expectations, and responsibilities.

🔐 Security-Specific Clauses May Include:

📑 What to Monitor:

🌍 Real-World Example:

An organization contracts a cloud email provider with an SLA requiring 1-hour breach notification, daily backups, and a max recovery time objective (RTO) of 2 hours.

🧠 Summary

7.5 – Apply Resource Protection

This section objective ensures that sensitive information and supporting assets are properly managed and protected throughout their lifecycle—covering storage media, data at rest, and data in transit.

🔷 1. Media Management

✅ Definition

Media management involves the secure handling, storage, transport, and disposal of information-bearing media (e.g., hard drives, USBs, backup tapes).

🎯 Objectives:

🔐 Key Practices:

🌍 Real-World Example:

An IT department logs all backup tapes leaving the data center. Tapes are stored in a secure offsite location and only accessible via authorized couriers.

🔷 2. Media Protection Techniques

✅ Definition

Measures to protect media from unauthorized disclosure, alteration, or destruction.

🔧 Core Methods:

🌍 Real-World Example:

A healthcare provider decommissions laptops by running a secure erase utility, followed by physically shredding the hard drives in line with HIPAA compliance requirements.

🔷 3. Data at Rest and Data in Transit

🧩 Data at Rest

Definition:
Data stored in a persistent state (e.g., on hard drives, cloud storage, databases).

Protection Mechanisms:

📌 Security Tips:

🌐 Data in Transit

Definition:
Data actively moving through networks (e.g., emails, web traffic, file transfers).

Protection Mechanisms:

📌 Security Tips:

🌍 Real-World Example:

A financial institution encrypts database files at rest with AES-256 and uses TLS 1.3 to secure client communications on their website. All backups are encrypted and transported in tamper-proof containers.

🧠 Summary Table

✅ Key Takeaways

7.6 – Conduct Incident Management

Objective: To effectively manage security incidents across all phases — from detection through remediation — and enhance organizational resilience through continuous improvement.

Incident Management ensures the confidentiality, integrity, and availability of assets by addressing and containing threats in a systematic, repeatable, and timely manner.

🧭 1. Detection

🔍 What It Means:

The ability to identify events that could indicate a security incident by using proactive and reactive mechanisms.

🛠 Techniques:

🌍 Real-World Example:

A SIEM alerts the SOC to an unusually high volume of outbound traffic from a single host, potentially signaling a data exfiltration attempt.

🛡️ 2. Response

🧭 What It Means:

The initial, real-time reaction to confirmed security incidents. This step is critical to containing the threat before it spreads.

🔧 Actions:

🌍 Real-World Example:

After detecting malware in an endpoint, the device is quarantined from the corporate network to prevent lateral movement.

🔥 3. Mitigation

🎯 What It Means:

Efforts to limit damage and restore secure operations without necessarily completing full recovery yet.

🔐 Steps:

🌍 Real-World Example:

A cloud provider enforces new access rules and MFA policies after identifying that attackers gained access using an employee’s leaked password.

📢 4. Reporting

📝 What It Means:

Documenting the incident comprehensively and communicating status and impact to stakeholders.

✍️ Key Reporting Elements:

🏛 Regulatory Triggers:

🌍 Real-World Example:

A retailer suffering a credit card breach must report to law enforcement, payment processors, and customers, along with the PCI Security Standards Council.

🔄 5. Recovery

💻 What It Means:

Return systems to a known good state, ensuring security controls are in place to prevent repeat compromise.

🔁 Key Activities:

🌍 Real-World Example:

A business hit by ransomware recovers encrypted data from a cloud backup, reinstalls affected machines, and enhances endpoint protection software.

🛠️ 6. Remediation

🧠 What It Means:

Implementing long-term fixes to eliminate vulnerabilities that caused or enabled the incident.

🛠 Focus Areas:

🌍 Real-World Example:

A phishing attack succeeds due to a lack of MFA. After containment, the company mandates MFA organization-wide and trains staff on phishing recognition.

📘 7. Lessons Learned

🔁 What It Means:

Analyze the incident after recovery to identify root causes, response gaps, and improvements to processes, people, or technology.

🔍 Key Steps:

🌍 Real-World Example:

A company realizes its detection rules failed to flag beaconing malware. Post-incident, they fine-tune SIEM logic and implement automated response rules.

📊 Incident Response Lifecycle Summary

✅ Key Takeaways:

7.7 – Operate and Maintain Detection and Preventive Measures

This section focuses on deploying and sustaining technologies that both prevent and detect security incidents in real time or proactively. The goal is to provide continuous visibility, control, and response capabilities across enterprise environments.

🔸 1. Firewalls

🔍 Definition:

Firewalls enforce network security policies by controlling inbound and outbound traffic based on configured rules. They serve as the first line of defense.

🔧 Types of Firewalls:

📘 Example:

A NGFW at a university identifies abnormal outbound DNS requests from an internal server and blocks them, preventing data exfiltration.

🔸 2. Intrusion Detection and Prevention Systems (IDS/IPS)

🔍 Definition:

These systems monitor network or host activity to detect (IDS) or prevent (IPS) unauthorized or suspicious behavior.

📌 Types:

📘 Example:

A financial firm uses an IPS to block SQL injection attempts in real time that target a customer portal.

🔸 3. Whitelisting / Blacklisting

🔍 Definition:

These are access control mechanisms for applications, IPs, or processes.

🛠 Use Cases:

📘 Example:

A power utility restricts all endpoints to run only whitelisted SCADA software to avoid unapproved tool execution.

🔸 4. Third-Party Provided Security Services

🔍 Definition:

External services that deliver specialized security capabilities, often 24/7 and scalable.

💼 Types:

📘 Example:

A retail company outsources its SOC to a managed service provider that triages alerts and responds to ransomware attempts during non-business hours.

🔸 5. Sandboxing

🔍 Definition:

A controlled, isolated environment where potentially malicious files or code can be executed safely to observe behavior.

🎯 Capabilities:

📘 Example:

A suspicious Word document is opened in a sandbox and shows behavior like contacting a command-and-control server, leading to its quarantine.

🔸 6. Honeypots / Honeynets

🔍 Definition:

Decoy systems or networks designed to lure attackers, allowing defenders to study methods and collect intelligence.

🧠 Benefits:

📘 Example:

A cybersecurity team deploys a honeypot SSH server that logs brute-force login attempts and provides intelligence for updating firewall blocklists.

🔸 7. Anti-malware

🔍 Definition:

Software solutions designed to detect, block, and remove malicious code.

⚙️ Features:

📘 Example:

A law firm’s anti-malware tool identifies ransomware behavior (mass file encryption) and immediately terminates the process and alerts the SOC.

🔸 8. Machine Learning (ML) and Artificial Intelligence (AI) Based Tools

🔍 Definition:

These tools apply intelligent algorithms to monitor, predict, and detect threats more accurately and faster than rule-based systems.

🤖 Applications:

📘 Example:

An AI-powered tool detects that a junior employee’s account accessed 10,000 files in one hour — an anomaly — and automatically disables the account while alerting IR teams.

📊 Summary Table

🧠 Key Considerations

🔐 Exam Tips

Exit mobile version