Cissp - Domain 7 - Operations Security

Front 1

Security controls that depend on secrecy.

Back 1

Security through obcurity

Front 2

Controls that exist in a layered fashion.

Back 2

Defense in depth

Front 3

Controls that aim to stop an attack from succeeding.

Back 3

Preventive controls

Front 4

Controls that aim to identify malicious activity on the network.

Back 4

Detective controls.

Front 5

Controls that aim to restore a resource to its pre-attack state.

Back 5

Corrective controls

Front 6

Focuses on the features and system architecture used to ensure that the security policy is enforced during system operations.

Back 6

Operational assurance

Front 7

Four types of recover under the common criteria.

Back 7

Manual, automated, automated without undue loss, function

Front 8

Mechanisms that require human intervention to retore the system to a secure state.

Back 8

Manual recovery

Front 9

Provides for at least one type of service discontinuity recovery to a secure state without human intervention. May require human intervention for recovery from other discontinuities.

Back 9

Automated recovery

Front 10

Provides for automated recovery but strengthens the requirements by disallowing undue loss of protected objects.

Back 10

Automated recovery without undue loss

Front 11

Provides for recovery at the level of particular security functions ensuring either successful completion or rollback of data to a secure state.

Back 11

Function recovery

Front 12

Steps taken by an organization to ensure that a system is designed developed and maintained using formalized and rigorous controls and standards.

Back 12

Lifecycle assurance

Front 13

Three parts of lifecycle assurance

Back 13

Security testing, design specification and verification, configuration management

Front 14

Five steps of the change control process.

Back 14

Applying, cataloging, scheduling, implementing, reporting