welcome to my cissp exam cram series this is the complete course we'll call it the 2022 update we're covering all

eight domains of the cissp exam as well as my recommended exam preparation strategy incorporating multiple learning

techniques to help you prepare more quickly and effectively and as a cyber security strategist for

organizations around the world and a chief information security officer for a regional bank and an educator i can

promise you i use the knowledge i gained in the cissp exam every day more importantly for you last

year alone i helped thousands achieve cyber security certifications including the cissp all without expensive boot

camps and that is quite simply my goal to help you get further faster in your exam prep

so we'll be focusing on the key points of every topic we won't spend time speaking unnecessarily

about any topic we're going to focus on the key characteristics of each concept that will help you identify right and

wrong answers quickly on exam day this content utilizes several proven learning methods that have worked for

many candidates before you myself included to accelerate your progress and i will share the techniques that you can

apply in your study on your own i want to speak for a moment about my pace i intentionally speak at about 115

to 125 words a minute if english is not your first language this may be just right for you

if you do speak english as a first language you might find that increasing the speed to 1.25

may be better for you whatever works for you i just wanted to make you aware of that small detail

and by design i'm not focusing on every single topic that appears in the official study guide i'm focusing on

high probability exam topics high difficulty concepts frequent sources of questions from my

exam candidates and areas that require process memorization at the end of the day i want to direct your focus to the

high probability high difficulty areas so you're optimizing your prep you're making the best use of your exam study

time and this strategy has proven to work out well for exam candidates thus far and in

this update i'm simply turning the knobs a bit tuning this strategy further to make it a little bit better still

but in terms of what we're covering in this video we're going to talk about my

recommended exam prep strategy so the techniques that i suggest you use that many candidates before you have used

that i myself have used to prepare for the cissp exam more quickly and effectively we'll touch on domains one

through eight so every domain of the exam and i will also offer a few separate shorter videos to drill down on

what students report to be the most challenging areas and i will call those out at the appropriate points in this

video anywhere i can there's a table of contents in the video

description so at any point if you should want to skip ahead to a specific topic a specific domain feel free to do

that and as with all of my videos you'll find a pdf copy of this presentation

available in the video description you can click and download no sign in required

and a link to additional resources faqs exam updates and errata if there is any will be in the description beneath the

video and you can't be the first to benefit from this material but you may be the

next and i wanted to just share what a few other learners have said amongst the many testimonials we've seen

throughout the last year and while no course is perfect i wanted to give you a comprehensive study

resource and system without the hefty price tag and if we look at the eight domains of

the exam between the 2018 and the 2021 releases you'll see that the same eight domains are present in 2021 as were

there in 2018 and the weighting of these domains has changed very little as you can see here

if i were to describe the updates in the 2021 release of the cissp i would say the updates are incremental

the new syllabus is not that much different from the earlier versions you'll find there's no change in

experience requirements or the number of domains the content in subdomains of course has been expanded to keep up with

the changing times that's no surprise there's almost no change in domain weights as you saw

if you happen to live in a country where you don't get the new computer adaptive testing or

cat exam you'll find that the linear exam which is 250 questions and six hours long has not changed and there's

no change in the cat exam details which i'll touch on in just a moment and a few new topics have been

introduced in some of the domains to keep up with the changing times i will cover those topics in line as we cover

domains one through eight in this course i want to fill you in on the details of the cat exam format cat stands for

computerized adaptive testing and as of right now march 2022 the exam is three hours long with a hundred to 150

questions the number of questions depends on your performance the exam adapts based on your answer and it aims

for a 50 50 probability that you will get the answer to the next question incorrect so it's going to dial the

difficulty up and down based on your performance and the answers are final there's no going back which is why many

myself included think this makes the cat exam more difficult

you need a seventy percent to pass the exam some of the questions are not scored

they're pre-test unscored questions used for research for future exam changes nothing you can do about it don't worry

about it only pass or fail are recorded and if you fail even one domain you fail

the exam so it pays to make sure that your knowledge is above the passing bar for every single domain in the cissp

body of knowledge as you prepare for the exam i also wanted to tell you about a

recently announced change to the cat exam that's coming in june so the current exam includes 25 pre-test

meaning unscored questions 25 more items will be added to that pool bringing the total to 50 pre-test items

so the exam will then be 4 hours and 125 to 175 questions but no other changes to the

syllabus or content which means no real change in how you prepare for the exam as you are right now

and now i want to take you through my recommended strategy for preparing for the exam if you've seen this before feel

free to go to the video description and fast forward to domain one but if not we'll start with the

materials so i recommend the official exam study guide the ninth edition in its electronic form you'll have access

to a thousand practice questions online as well as a little over a thousand flash cards now and the electronic

version is easily searchable that's why i recommend you get the ebook you can buy it at amazon.com it's a touch over

40 u.s at the current time but do make sure you get the ninth edition which is the

update for the 2021 release of the cissp exam so let's start with the million dollar

question that we see frequently when we're preparing for the cissp and that is

how to think like a manager and i'm going to give you here the short version think like a manager

in five minutes or less so it starts with due diligence versus do care and it's really about knowing

our role so due diligence is practicing the activities that maintain the do care effort that's the

book definition not very helpful is it now the do care definition is doing what a reasonable person would do in a given

situation it's sometimes called the prudent man rule but what you see here right away is that

these two concepts work together that due diligence supports do care and these together will reduce senior management's

culpability their liability when a loss occurs both their liability for their own organization and those

in either direction of their supply chain i want to explain these two concepts to you a bit differently in a

way i think will resonate with you so due diligence and do care can really be looked at in the context of a

decision that line in the middle is our decision so on the left we have due diligence

this is the research the planning and the evaluation that frequently happens before the decision

not always but largely before the decision and due care includes implementation of

security controls operation and upkeep of those controls and reasonable measures to secure our organization and

its resources that's the doing after the decision so due diligence

increases understanding and reduces our risk in a given situation and do care ensures that we take those reasonable

measures as outlined in that prudent man rule so i mentioned that due diligence

happens largely but not always before do care so that evaluation process is a recurring process we need to make sure

that our reasonable measures that we put in place continue to be effective over time so we're going to come back and

reevaluate on a recurring basis through internal and sometimes external audits another way to look at due diligence and

do care that may help you remember these and keep them separate and clear in your mind for the

exam is that due diligence is about thinking before you act and do care tells us that actions

speak louder than words another way we see this labeled is due diligence is do detect the d d

and do care is do correct so one of these is about the research and evaluation and the other about taking

appropriate action so separating these into the before and after in your mind may be more helpful

so let's look at examples of due diligence we have knowledge and research of laws and regulations

industry standards and best practices and on the do care side we have delivery or

execution including reporting security incidents security awareness training and disabling access of users separating

from the company in a timely way and thinking like a manager is all about knowing your priorities so if we look at

our security planning horizons from operational to strategic so operational being short term and strategic being

longer term as a chief information security officer you really deal with risks that are

escalated to the top and you send down the objectives as you see them

in terms of their importance so your focus should really be right up here at the top of the pyramid

at the strategic level you're thinking about human safety business continuity protecting profit reducing liability and

risk and you are passing objectives down to the tactical and operational teams which they will implement in the form of

policy and planning and then actually implementing those recommendations and operating the environment on a

day-to-day basis and one more perspective that may prove helpful is assume that you are in that

organization to advise not to touch so during the exam think of yourself as an outside security consultant advising an

organization you're there to advise on strategy priorities and safety you're not doing you're not laying hands on the

keyboard this may help bring focus to process your role to due diligence and do care now if you're interested in the

long version of thinking like a manager check out my cissp mindset video it's right at half an hour it is the full

story it does also include me walking through a couple of practice questions to show you how you can use this logic

to reason your way to the best answer on exam day now let's take a look at some of those

learning techniques i promised at the beginning of this video the fact of the matter is there is no award for longest

study time whether you prepare for this exam in two weeks or two months or a year and a half

a pass is a pass and so if we can prepare effectively actually learning this content for the long term without

spending a year and a half doing so we should absolutely do that and

the number one reason that i am not a fan of those five-day boot camps where you spend two or three thousand dollars

and then go take your exam on day six is due to the length of time it takes to memorize anything to truly learn

anything i can commit facts to short-term memory you know quickly by repeating my

learning spacing my repetition out over a period of hours in fact with my fifth repetition only including a 48 hour gap

within a week i can commit facts to memory very quickly now to commit something to memory for

the long term to really onboard that for the duration of your career typically takes more time and how much time it

actually takes depends on your level of exposure and experience to these concepts but you can see if you're

starting from scratch to truly memorize anything for a long time can take repetition over a period of days weeks

and even months and there's a lot of power in repetition and i'll show you some techniques that

we can use to repeat our learning in different forms

whether we're working on those short-term intervals or the long-term intervals we call this spaced repetition

and the fact of the matter is between your sessions what you'll find from your first

study session to your second to your third is that with each successive repetition you are remembering for

longer and you are forgetting less information what you'll find is that your forgetting curve we call it becomes

shallower with each repetition using this spaced repetition technique and it's not purely about memorization

we do need to identify our weakest areas and focus our repetition on the topics where we need

work and we'll talk about how to do that in just a moment but at the end of the day our focus is

to understand these concepts not just memorize them studies have long shown that understanding a subject before you

memorize greatly improves your retention because you're not just memorizing words and the exam will assume that you

understand when and where concepts fit you need to be able to apply these concepts in the

right scenarios so one learning technique that makes memorization easier is what we call a

mnemonic device or a memory device and a common memory device is an acronym and i'll show you an example in a moment

but our mnemonic devices are best when they are simple they are relevant to the topic and

visual where we can make them visual so let's look at a couple of examples here so we'll start with a first letter

mnemonic and a good example of a first letter mnemonic is the osi model so back in the

90s i remember memorizing the osi model using a first letter mnemonic please do not throw sausage pizza away that was

layers one through seven and then in the reverse all people seem to need data processing so one could argue that we

could make this more relevant by changing the words in our mnemonic let's try please do not toss security

processes aside whatever works for you but we could argue that's more relevant another mnemonic here comes with the

incident management framework so our acronym here is drm rrl

drum roll if we pronounce it the letters don't spell it out quite right but you see i can add a visual element here as

well to make it easier still for me to remember that framework that process another technique that's useful when

we're dealing with large amounts of information is chunking it's the process of breaking information into smaller

pieces or chunks that make sense so let's take cryptography as an example we have asymmetric cryptography we have

symmetric cryptography hashes block ciphers so we could break cryptography into these chunks for

example and then i can break those categories into smaller chunks yet let's take hashes for example i'll break this

into chunks based on a unique property i find within these so let's take hash algorithms i'll take the

message digest family and i see here that for md 2 4 and 5 they each have a hash value length of 128. i see that by

and large they're not still in use with md5 there are some exceptions to that it's still used with file hashes

but in the cryptographic context not so much let's take the shaw family this is

secure hash algorithm what i notice here right away is that the hash value length matches the name i can see here that

most of these are still in use certainly all of the sha-2 family is still in use but shaw 1 is not that's a chunk

i notice here that the hash value length matches the name of the algorithm that's useful

in rounding out our exam prep strategy i want to talk you through what i call the 80 20 strategy for identifying your 20

weakest area so you can spend 80 percent of your time there so it starts with the practice exams now

whether you get the practice exams from the official study guide or elsewhere doesn't matter so much i'm going to show

you how to use the exams in the official study guide to drill down to your weakest areas on a per domain basis and

that's really the important question here is how can i best use these practice quizzes to assess my exam

readiness because the fact of the matter is if you get to exam day and you ask yourself am i ready if you don't know

the answer to that question then the answer is no and the way i suggest you do this is by

looking at how the book is organized per domain so chapters 1 to 4 in the book for example

map to domain 1 security and risk management chapter 5 maps to asset security

chapters 13 and 14 mapped to domain 5 identity and access management so if we use

the quizzes at the end of these chapters we can focus our learning to find our weak areas in that domain

and one of the more common questions i receive is how do i get access to those online resources that are promised in

the book so if i just go to the electronic copy of the book i'm going to search for test

bank one word and that will bring me to the section here that describes the interactive online learning environment

and test bank and you're instructed to go register at wiley.com you'll be prompted with a challenge you can only

answer if you've purchased the latest copy of that book and once you sign in to the website

you'll be presented with a page similar to this i'll find the cissp i'll

log in there and ultimately i come to a page that looks just like this it's efficientlearning.com

and when i log in here i've gone through the process of registering

i'll see the products that are available to me and i can go to the test bank so what you need to know here is that

with these 1000 questions they are divided into exams in the quiz builder

but we can customize entirely so what i'll do is uncheck question topic so i've unchecked all questions and if i go

into those chapters i can select specific chapters to create a custom quiz so for example chapters

one through four i mentioned were domain one i will select just those four chapters

i'll scroll to the bottom and here i can tell the wizard the number of questions i'd like

so i want all 80 questions and now i can take a quiz that is only focused on domain 1 which is covered in chapters 1

through 4. and on that same screen where i selected the

test bank the practice quizzes you'll also see an option to select the flash cards

but i commonly find candidates get into the test bank here and they can't quite figure out how do i take a quiz that

shows me my weaknesses in a particular domain well that's how you do it you map the chapters out as you see here and

again you can download this as a pdf so you'll have this information at your fingertips

so moving through the 80 20 strategy as we go through that spaced repetition we have our practice exams that will help

us understand our weak areas which will spur some targeted reading we'll go read a little more on those topics where we

have weakness to better understand the material we'll come back and review the powerpoint in this video and some of the

other targeted drill down videos i have we'll look at live quiz or flash cards

so the flash cards are great if you don't have a partner to help quiz you for example my spouse my wife helped

quiz me as i was preparing but if you don't have a partner then you can use those flash cards to quiz yourself

on those topics but at the end of the day research has proven that we all function best when we learn using a

variety of techniques so variety is the spice of life and it is very effective in learning subjects more quickly

and there you have it that's my system which means it's time for domain one which is security and

risk management now a few key areas you'll be expected to know for domain one include risk and risk analysis

you'll be expected to know the quantitative risk analysis formulas and how to apply them

threat modeling concepts and processes and the frameworks that go with that compliance legal regulatory and privacy

you'll be expected to have some summary knowledge of particular u.s laws and in the case of the eu gdpr a european law

that applies to u.s companies professional ethics you'll need to know the isc squared code of ethics by heart

security governance principles like itil and finally security policies standards procedures

and guidelines you'll need to know the difference between these four including which are suggested and which are

mandatory in terms of what's new in domain 1 in 2021 when we break down the

exam syllabus 1.1 is now understand adhere to and promote professional ethics i would say generally speaking

this is a non-event there's fundamentally no change from 2018 in terms of what you'll be expected to know

for domain one so i mentioned you're going to need to know

the cia triad by hearts the cia stands for confidentiality integrity and availability you'll sometimes see this

expressed visually in the form of a triangle with confidentiality being the first followed by integrity and

availability so confidentiality is about secrecy or privacy and in the technology context

that means access controls that help ensure only authorized subjects be those people or services can access objects

whether that object is data or a system so integrity ensures that our data or system

configurations are not modified without authorization if a threat actor modifies data without

authorization we've now lost integrity that data is now no longer true and reliable

and confidentiality and integrity don't matter if we don't have availability so authorized requests for objects those

systems that data must be granted to subjects within a reasonable amount of time

the cia triad is covered in chapter one of the official cissp study guide you'll want to know cia very well for the exam

definitely going to come up i mentioned the cissp code of ethics i'm not going to read you the full

code here but at a high level it covers protecting society infrastructure the commonwealth acting

in a manner that is honest and responsible and legal providing competent

service to others and to advance and protect the

profession the code of ethics itself is much longer than this you want to give the whole thing a quick read and

personally i find most of what's in here is common sense but but you'll want to have some

familiarity with the terminology they use in here in case it comes up on a question

so i want to shift gears and talk about security policy development so at a top tier security policy is your document

that defines the scope of security that's needed by your organization the assets that need to be protected and to

the extent we should go to to protect them but there are four levels of security policy

development so it starts with acceptable use policy which is designed to assign roles within an organization and to tie

responsibility to those roles then we have security baselines which define a minimum level of security that every

system in the organization needs to meet then we have security guidelines which offer

recommendations on how standards and baselines should be implemented and these provide operational guidance for

both our security professionals and our users and then finally we have procedures

which are those detailed step-by-step documents that describe the exact actions that are necessary to implement

a specific security mechanism a control or a solution in protecting our data or infrastructure

so tidbit for the exam when you're developing new safeguards you're establishing a new baseline a new

security baseline which means that maintaining compliance with existing baselines is not a valid consideration

point now let's move on to risk management and risk analysis and i want to start with risk category so a

category is a group of potential causes of risk so at a high level you have damage which results in physical loss of

an asset or an inability to access that asset and then when it comes to information we have disclosure and

disclosing critical information regardless of where or how it was disclosed if this was a malicious act as

a result of a threat actor or unintentional on the part of a well-meaning user

and we have losses so losses might be permanent or temporary which could include altered data or inaccessible

data so data altered without authorization affects integrity if we think about it from a cia perspective

and then if you think of an attack like ransomware for example which renders data inaccessible

and permanently inaccessible unless we can recover and then we have risk factors and risk

factors factors are something that increase risk or susceptibility to loss

so in the realm of risk factors we have physical damage natural disasters power loss vandalism we have malfunctions so

whether that's a failure of a system or a network or a peripheral or the hvac system we have attacks now these are

purposeful acts of of a threat actor whether that's from the inside to the outside like unauthorized disclosure for

example so continuing on risk factors human errors now these are usually considered

accidental incidents where attacks are generally purposeful incidents then finally we have application errors which

would be failures of the application including potentially the operating system

now security planning may come up on the exam and there are three types of plans you need to be familiar with the first

is the strategic plan this is the long-term plan that's fairly stable it should generally include a risk

assessment and the strategic plan typically has a five-year horizon and you'll update it annually this helps to

align the goals of the security function with the organization's missions and objectives

the next one is the tactical plan this is a midterm plan it's developed to provide a little more details on the

goals of the strategic plan this is typically going to have a horizon of about one year the tactical plan gives

us a little more flexibility we can make some ad hoc adjustments here when circumstances dictate and the final plan

of the three is the operational plan so this is a short-term highly detailed plan that drills down on the strategic

and the tactical plans and by short term we're typically talking about monthly or quarterly the

operational plan will have budgetary figures staffing assignments scheduling and typically step-by-step

implementation procedures so now let's talk about response to risk so we have several ways we can respond

to risk the first is risk acceptance and and that means simply doing nothing we simply accept the risk

and the potential loss if the threat occurs and if the safeguards or counter

measures outweigh the potential loss in terms of their cost then just simply accepting a risk might make sense

the next option is risk mitigation or sometimes you'll hear this called risk reduction and when we mitigate risk we

implement uh countermeasure and we accept the residual risk that's the risk that's left over

once our safeguards our security controls are in place

now in risk assignment this is also called risk transference we're transferring or assigning that

risk to a third party like in purchasing insurance against damage and outsourcing to companies with

specific expertise is another way we commonly see risk assigned or transferred

so next is risk avoidance so when the cost of mitigating or accepting a risk are higher than the benefits of the

service itself then avoidance is a good idea so for example

i might decide to locate a business in kansas instead of florida to avoid hurricanes if i decide that the cost of

mitigating the risk of hurricane damage to my business is too great so continuing down this road risk

deterrence is another potential response and implementing deterrence to would-be violators of security and and policy

is a pretty common response in the real world and deterrence would include things like

implementing an audit policy to deter folks from malicious behavior for example in the

i.t department security cameras are security guards to defer deter

unauthorized entry onto our premises or even something as simple as warning signage

and then finally we have risk rejection and i want to point out this is generally considered an

unacceptable response it's a possibility but it's not acceptable this means to simply

reject or or ignore the risk just treat it as it doesn't exist

obviously never a good idea to just bury our head in the sand because problems don't just go away

but remember handling risk is not a one-time process this is an area you're going to have to revisit on a recurring

basis and refresh your responses to risks and to determine if the nature of these risks has shifted in

some way and require changes on your part let's talk about

risk management frameworks now the primary risk management framework referenced on the cissp exam

is the nist 800-37 framework and that's currently in revision 2.

if you'd like to read it end to end i'll have a link to 800-37 in its latest revision down in

the description for this video now you'll also hear some other risk management frameworks mentioned but i

want to point something out here so from the cissp study guide it says consider the following risk management frameworks

for use in the real world so the key there is for use in the real world so they mention octave and fair

and tara and the fact that they say consider these for use in the real world while mentioning

that nist 800-37 is the primary framework that tells me i'm not going to worry much about these i'm going to

focus on nist 800-37 now this nist framework establishes a

process steps and you with any process in cissp you need to make sure you know these steps in order and really it's

depicted by some as a preparatory step followed by six main steps i'm going to just give you the

seven steps so when we talk about that preparatory step uh preparing to execute

the risk management framework is that preparatory step so so if you ever see nist 837 presented as six steps it's

because they leave the prepare off so second step is categorizing your information systems

and we're looking at the information process stored and transmitted by the system based on analysis of the

potential impact for loss next is selecting security control so we need an initial set of controls for the

system and to tailor those controls to our reality to reduce risk to an acceptable level

based on our risk assessment step four we implement security controls and we describe or document how those

controls are employed within our systems and our environment and then we're going to assess those controls to determine if

they're implemented correctly if they're operating as we intended in our environment and most importantly are

they producing the desired outcomes are they meeting our security and privacy requirements and expectations

so next we authorize the system and by that i mean we authorize the system to operate in a normal

environment and at that point the organization is accepting the risk formally

for the system and because this is not a one-time event your risk management is a

process uh step seven is monitoring our security controls

periodically assessing that our controls are effective documenting any changes to the system and

conducting risk assessments periodically as necessary and remember i mentioned this is a

process right for any process in cissp we need to know those steps we want to know them in order some folks will use

a mnemonic device or a memory device that's called using the first letters of these steps in the framework

so for example for for these letters for pcs i am i could use the mnemonic device people can see i am always monitoring

so at test time if i'm a little foggy on nist 800-37 i can at least get the first letter of each of these seven steps by

remembering my mnemonic device people can see i am always monitoring that was something we did very commonly

with the osi model back in the day and we'll talk about that in a later domain in this series

and a few other things for the exam so do remember when you're talking about risk management and and risk analysis

not every risk can be mitigated that's just a fact and it's management's job to decide how

that risk is handled so when you hear me talk about thinking like a manager when you're taking the

cissp exam remember it's the role of a security professional to be a risk advisor to advise the decision maker who

is the manager and also when multiple priorities are present always remember human safety is

the most important i bring that up now that it may not even come up as a part of this domain but it's an important

point so i wanted to just mention it early on here left i i forget

remember to prioritize human safety when you're presented with many options and remember when legal issues are involved

calling an attorney is a valid choice it might not seem like a valid choice because it's technical folks

you may want to solve every problem but when we put our manager hat on calling an attorney is a great

example of risk transference right or or assignment we're

outsourcing our problem to an expert so let's talk for a moment about types of risk so residual inherent and total

are three types of risk

so we have residual risk which is the risk that remains even when

all our conceivable safeguards are in place that's the risk we can't get rid of

and at that point the risk management function has chosen to accept rather than to to mitigate or transfer or

assign that residual risk sometimes there's a bit of risk there we just can't shake

so we're accepting then there's inherent risk newly identified risk not yet addressed

with risk management strategies so another way of saying that is its inherent risk is risk that exists in the

absence of controls and this is one that that you don't really see in every cissp text i bring

it up because i've seen it a time or two and it's worthy of mentioning but total risk is the other that you want to be

very familiar with and that's the amount of risk an organization would face if no safeguards were implemented so

to say it another way if we just look at those three types of risk residual risk is after

controls are implemented that's the risk that remains inherent risk is risk that exists before we've implemented our

safeguards and then total risks would be the risk present without any safeguard so for the

exam you really want to focus on residual risk and total risk these are going to come up in a formula

and this is the first time i've mentioned formulas but formulas are very much a thing when we talk about

risk analysis and management on the cissp exam so a few tidbits for the exam

so be able to explain total risk residual risk and the controls gap which is the amount of risk that's

reduced by implementing safeguards we'll see controls gap in a formula and talk about that a bit more a little

later in this installment so to calculate total risk know this formula threats times vulnerabilities

times asset value equals total risk and we'll look at some of these formulas later in this installment because you

will need to understand the several formulas as they relate to to risk

and how to use them to arrive at good decisions so we can also express risk itself

as a formula and risk can be defined as as threat times vulnerability so yes you know threat and vulnerability are

expressed as numeric values as probabilities so stick with me to the end of the video

we'll we'll see more formulas here and we'll we'll look at a couple of examples to help you get the ball rolling

and if when we're done if maybe you'd like to see a video dedicated to nothing but the formulas that are going to come

up for you on the cissp exam just leave me a comment and

i can make that happen so i want to shift gears now from risk to risk analysis so so there are two

ways at the highest level to evaluate risk to our assets there's qualitative risk analysis and quantitative risk

analysis so quantitative assigns a dollar value to evaluate the effectiveness of our

countermeasures quantitative risk analysis uh really is the more labor-intensive of the two

methodologies it employs typically a lot of data collection and analysis using cost benefit analysis

it results in specific values that we're really what we're doing is removing guesswork

and opinions from the process it's really if if i were to describe quantitative risk analysis in one word

it's objective it requires a lot of information and effort typically but at the end of the

day it's going to assign a tangible dollar value so we can evaluate the effectiveness of our

response to risk so let's look at the risk analysis steps involved in quantitative risk analysis

so this is specific to quantitative risk analysis we're going to talk about qualitative in a moment

so step one is inventorying your assets and assigning a value and you might be asking yourself what's

that out what's that text out there in red i'm putting some some terms and some acronyms out here because these are

going to come up in formulas that we discuss later in this module so these are going to be important you'll wind up

revisiting this slide to to perhaps think think again through

these steps and and what the outputs of the step are so step two we're identifying threats

we're going to research our assets we're going to produce a list of all the possible threats to each asset

and here we're going to calculate ef which is the exposure factor and the sle which is the single loss

expectancy we're going to get to what these mean in just a moment i just want to set the stage for you so you know

what some of these outputs are and this will all come together when we talk about the formulas

step three you'll perform a threat analysis to calculate the likelihood of each threat being realized within a

single calendar year you're calculating the annualized rate of occurrence again that acronym is going to show up in a

formula here momentarily step four we're going to estimate the potential loss by calculating the annualized loss

expectancy and the fact that the word annual or the concept of yearly is coming up here

should tell you that this process is an ongoing process right this is a recurring process we're going to

revisit periodically within our organization it's not a one-time exercise step five we're going to

research counter measures for each threat and then we're going to calculate changes to the annualized rate of

occurrence so in other words how often is is this event going to occur

and what is our annualized loss expectancy based on the counter measures that we've applied

so if we've done our job right the the annualized rate of occurrence and the annualized lost expectancy are going to

be lower than when we started in step six we're going to perform a

cost benefit analysis of each of our countermeasures for each threat for each asset

to determine in a very dollars and sense fashion if we've made good decisions in our selection of countermeasures

so let's talk about qualitative risk analysis so qualitative risk analysis uses a scoring system to rank threats

and the effectiveness of our countermeasures relative to the system and the

environment it requires guesswork and estimation it definitely uses opinions however

it does provide meaningful results if i if i could summarize qualitative risk analysis in one word it would be object

subjective because it involves opinions and while it's going to tend to be less accurate it is a quick way we can make

some estimations that we can then use to guide our efforts in the deeper quantitative risk analysis so so a lot

of times qualitative risk analysis can serve as that way we take a five minute rough cut at the problems we're dealing

with i can rank impacts as low medium high i can throw out some percentages

to just get to a point that i know what i'm dealing with in terms of the probability and impact of of the threats

we're working with of the the risk we're trying to to deal with uh you should be familiar

with the delphi technique for the exam as well so in qual qualitative risk analysis this is uh basically anonymous

feedback and response used to arrive at a consensus a couple of other considerations when it

comes to risk analysis uh there's lost potential so so what would be lost if the threat agent is successful in

exploiting a vulnerability and then delayed loss and this is the amount of

loss that can occur over time because the reality is you don't lose

everything all at once in certain situations for example if an exploit

takes down your firewall and from in front of your web farm and your web farm is unavailable you

lose money over time as customers can't reach your website that's delayed loss and i mentioned threat agents here the

threat agents are what cause the threats by exploiting vulnerabilities the vulnerabilities are

the weaknesses in your assets or in your safeguards for that matter so i promised you we would talk about

those important formulas and that time has come so we're going to talk about the relevant

terms and the formulas that we use to calculate their results

so we have exposure factor single loss expectancy annualized rate of occurrence

annualized loss expectancy and safeguard evaluation so these all factor into

some key formulas that are definitely going to show up on the cissp exam so let's dig into these terms and the

formulas that go along with them so we'll start with exposure factor ef this is the percentage of loss that an

organization would experience if a specific asset were violated

by a realized risk so this is a percentage of loss so so ef or exposure factor is expressed as a percentage

single loss expectancy or sle so this represents the cost associated with a

single realized risk against a specific asset so this gives us

a one-time loss figure so the formula for single loss

expectancy is the asset value times the exposure factor so the asset

value is going to be a number a dollar figure the exposure factor will be a percentage which is expressed as a

decimal when we're doing the math so let's look at a sample here so if i

have an asset value on the left here of a hundred thousand dollars and a tornado is estimated to do thirty percent damage

to my asset so that's going to be point three my exposure factor is thirty percent

uh and my single loss expectancy then would be 30 000 or the asset value times

the exposure factor okay this is just the tip of the iceberg so let's keep going here

so annualized rate of occurrence or aro so this is the expected frequency with which a specific threat or risk will

occur within a single year so the annual rate of occurrence is an

important input for this next item

and that is annualized loss expectancy so this is the possible yearly cost of all instances of a

specific realized threat against a specific asset

so we look at that in a formula the the annualized lost expectancy the

ale is the single loss expectancy

times the annual rate of occurrence so so the sle is the one time uh loss

and then we take that times the annualized rate of occurrence so if we have an sle of 50 000

and we have an annualized rate of occurrence of say 0.5 because a particular threat only

occurs once every two years 50 000 times 0.5 is 25 000. so i've explained that simply there but

i started with an sle we'd already calculated let me take you through an end-to-end example of annualized loss

expectancy so we have an office building that's worth two hundred thousand dollars

and we estimate that hurricane damage uh would be fifty percent uh of the value of this building

and hurricane probability is one every ten years so ten percent or point one okay so we have to start by calculating

the single loss expectancy right so the single loss expectancy is the two hundred thousand dollar building times

the damage estimate of fifty percent or point five so our sle

is one hundred thousand dollars now we're going to take that sle and that factors into

our ale equation so we'll carry that hundred thousand dollars into the next equation here and that is the

single loss expectancy of a hundred thousand dollars times

the annualized rate of a current or aro and our hurricane probability is one

every 10 years so the annualized rate of occurrence is 0.1 so so if a hurricane probability was one

every single year that would be one even right but one every ten years means point

one so we take that hundred thousand times point ten and our annualized loss expectancy

is ten thousand dollars so what this tells us is that the safeguards we put in place

better not cost more than ten thousand dollars a year or we're spending more to protect this building than we're

essentially going to save so that gives us the the value of the safeguard so while

we're on that subject that that gives you a dollars and cents answer right so while we're on that subject let's

talk about how the value of the safeguard is expressed then so we call that

safeguard evaluation so good security controls will mitigate risk they're transparent

to users they're difficult to bypass but the last one here they're also cost effective so in our previous example we

saw that the safeguard shouldn't cost us more than ten thousand dollars a year or we were spending too much

relative to the reduction in loss so so safeguard evaluation has a formula so

it's the annualized loss expectancy before the safeguard minus the

annualized loss expectancy after the safeguard minus the annual cost of the safeguard

that gives us the value of the safeguard so we're really trying to answer the

question is the safeguard cost effective if we're spending more to protect an asset

than we're saving in ale then we don't have a cost effective answer there so there's your formula

expressed a little more simply so ale before the safeguard minus ale after the

safeguard minus the annual cost of

the safeguard so again i hope these examples have been helpful if you need more help with formulas if we need to do

a video with just the formulas go down to the comments drop me a note let me know we can make it happen

so the amount of risk reduced by implementing safeguards is known as the controls gap

and to see control's gap in a formula we can look at residual risk then so residual risk is total risk so

the risk and absence of controls minus the control's gap gives us that remaining

or residual risk so if total risk is a hundred thousand dollars the

controls gap is fifty thousand dollars our residual then is fifty thousand dollars

and the expectation that you know all of these formulas and how to use them make quantitative risk analysis one of the

most difficult topics on the cissp exam so one of the most important videos you can watch is my quantitative risk

analysis just the formulas video where i walk you through a real world example where we apply

those formulas to a realistic use case you'll find a link in the video description

the cissp exam will also test your knowledge of applying risk-based management concepts to the supply chain

so today most services are delivered through a chain of multiple entities that is to say

one product like a car for example really you know while it has a car company's

label on it likely includes components from multiple companies and certainly

may be transported by multiple companies to the dealership so a secure supply chain includes

vendors who are secure they're reliable they're trustworthy they're reputable and

you need to evaluate the vendors in your supply chain to ensure that's true so when evaluating third parties in the

chain you want to consider methodologies like on-site assessment visiting an organization interviewing personnel and

observing their operating habits to ensure they are as safe as they claim to be

document exchange and review and this means to investigate the means by which this organization

exchanges data sets and documentation as well as the formal processes by which they perform assessments and reviews

there's processor policy review so requesting copies of their security policies their

processes or procedures and you could finally

opt for a third-party audit so having an independent auditor provide an unbiased review of an entity security

infrastructure our next topic is one where i suspect you'll have some memorization ahead in

order to be prepared for exam day and that is threat modeling which can be proactive or reactive but the

goals are are to eliminate or or at least reduce threats significantly and your threat modeling approaches

can take one of three common forms they can focus on assets where asset valuation

is is used to identify threats to valuable assets we want to to focus our our spending on assets that

have value to the business right focusing on attackers is another common approach where

the the process is focusing on the attacker's goals and then finally

focused on software where considerations center on potential threat against the software the

organization develops or implements so let's talk through a few of these models remembering that they can focus on

assets attackers or software so one of the

more common threat modeling frameworks and it's mentioned in the cissp is stride which was actually developed by

microsoft so so remember that in case it gets called out as a detail in a question

so the stride model focuses on the the potential threat so spoofing

tampering repudiation information disclosure

denial of service and elevation of privilege so because these were developed by

microsoft we see this as a software focus right it's focused on potential threats

to to software and i believe most of these are going to be pretty well known to you repudiation

might be a term that you're not super familiar with and that's the ability of a user or an attacker to deny having

performed an action or an activity and that often takes the form of the attacker staging the situation to

blame someone else and then there's spoofing that involves falsified identity tampering which is

data manipulation you know restaurant transit but remember stride is developed by

microsoft and remember the terms there that uh that map to the acronym right all right so moving on in the threat

modeling discussion let's talk about pasta which focuses on developing counter measures based on asset value

and there are seven stages of pasta but the key here it's a

threat modeling approach that focuses on asset value which really gets to the heart of the

matter right because when we're dealing with with risk management it really comes down to

implementing cost effective control so when we're modeling threats focusing on asset man

on asset value is a great idea okay moving on there's the vast threat modeling approach which

stands for visual agile simple threat so this is based on agile project management principles

so the bottom line goal of vast is to integrate threat management into an agile

programming environment so next up is

the dread model which is based on the answers to five questions so damage potential so how severe is the

damage likely to be of the threats realized reproducibility so how complicated is it

for attackers to actually reproduce to implement the exploit exploitability so how

difficult is it to perform the attack affected users this is really about headcount right how many

users are likely to be affected by the attack as a percentage and that could mean

internal users and that could mean you pay the bills users your customers

and then discoverability so how difficult is it for an attacker to discover this

weakness because a significant weakness five or six layers deep in our defense and depth

may not be such a big problem for us so certainly something we might want to

address but maybe we'll will push it down the priority list so rounding out our our threat modeling

discussion is the trike model which focuses on acceptable risk it's an open source threat modeling process that

implements a requirements model that essentially ensures the assigned level of risk for each asset as acceptable to

stakeholders so remembering that trike is risk focused and it implements a requirements model

should cover you if it comes up on the exam and to round out domain one i want to talk to you about

cobit which stands for control objectives for information and related technology it's

not a great mapping to the cobit acronym frankly and this is a security control framework sometimes

described as a framework for i.t management and governance it's based on five principles so meeting stakeholder

needs covering the enterprise end to end so treating our our enterprise

as as the full scope of our focus applying a single integrated framework

so so continuity of a centralized coordinated approach enabling a holistic approach

and separating governance from management so holistic approach and separating governance from management

are key concepts or i think and we're expecting to see little or no coverage

on the cissp exam in fact the official study guide mentions it only briefly and goes on to promise that there's

going to be no real depth of coverage on the cissp exam so this should get you through with the basics around

cobit an important aspect of threat modeling you may not be acquainted with yet is

diagramming potential attacks so determining potential attack concepts is achieved

through visualizing your infrastructure and identifying threats

or identifying potential vulnerabilities that may be exploited so let me just sketch out a simple

example for you here so let's diagram some potential attack so i have users

that come through my perimeter my user web server boundary we'll call it so they hit my web service here

and i have a database back here a sql server where we'll pull some data from a database

so my user starts by logging in to the web service at some point they may make a request

that then causes that web service to go back and retrieve data from my sql database

i'd imagine there's uh you know maybe even a different authentication process here from

a service principal or an entity down to that database versus the user logging in manually here and i can perceive

different threads here because i'm visualizing so just right off the cuff i can imagine that on a login form

brute force password attacks dictionary attacks might be common if attackers wanted to just guess

at user names and passwords and if they were to register for our service maybe they

could get an idea of the username requirements and then just start you know as i mentioned a

dictionary attack now if i think about a web service talking to a database the first thing that always comes to mind is

sql injection so as an attacker i could try to exploit

maybe some poor value handling on a web form to perform a sql injection attack

and i'm out of space here but and i could go quite a bit further as you can see but this gives you an idea of that

diagramming process at a basic level so let's talk about reduction

analysis in threat modeling so in reduction analysis i'm going to break a system down into its uh its parts which

makes it much easier to identify the essential components of each element and take notice of where we might have

vulnerabilities and and you know likely points of attack so

just to go through this i could look at trust boundaries so any location where the level of trust or security changes

so a trust boundary in your application from say a an access control perspective would be

where a specific role or privilege is required to access a resource or an operation that would be a change in

trust data flow path so looking at the movement of data between locations

and what exposures there are that might allow attackers opportunity to to capture or breach that data input

points locations where external input is received so in our our diagramming example uh a web form where we're

logging in or a web form or we're submitting a request that that calls back to sql that's going to be

an area that would be most likely

a possibility for attack a likely target perhaps privileged operation so any activity

that requires greater privileges than that of a standard user account that's going to be a red flag area

an area will want to give special attention then finally details about security

stance and approach so so essentially just the our declaration of security policies foundations are our assumptions

in a given scenario for for a service or infrastructure so after we go through that

deconstruction and documentation process then we want to rank or rate the threats we can use the dread methodology we just

talked about or a high medium low rating for example so i want to clarify a few things around

security control so your security controls are the measures for countering or minimizing loss or unavailability

of your assets your services your apps etc and

you'll hear the term safeguards and counter measures we've used those quite a bit today and they may seem to be used

interchangeably at the end of the day the main difference between a safeguard and a

countermeasure is safeguards tend to be proactive and counter measures tend to be reactive

let's talk about the categories of controls there are three categories of security controls they're technical or

logical or sometimes called which involves the hardware or software mechanisms used to manage access and

then you have administrative controls which are policies and procedures that are designed

by the org security policy or other regulations and requirements administrative controls for example

might include hiring practices background checks data classifications and labeling security awareness and

training methods and then you have physical uh control so the physical category are

items you can physically touch so there we're talking about guards fences motion detectors lock

doors seals sealed windows lights laptop locks etc so be familiar with these control

categories and be able to name off a few in each category as i just did for you now

so next let's dig into security control types so you have deterrent

control so these are deployed to discourage violation of security policies

deterrent controls could include uh you know audit policies security awareness training locks fences security badges

they're designed to discourage violation and then we have

preventative controls these could be

technical controls like firewalls or intrusion detection systems or it could be a physical control like a

fence or a gate or a man trap and technically there could be some overlap between deterrent controls and

preventative controls the main difference here is deterrent controls really rely on on somebody making a

decision to not do something where preventative controls are really designed to actively stop the unwanted

behavior and we have detective controls which are deployed to discover or detect unwanted

activity so defining characteristic of detective controls as they really detect the activity after the fact right

they detect something in progress motion detectors cctv cameras audit trails honey pots

and you'll find some surprising elements listed as detective controls like

mandatory vacations for example job rotation because if you're rotating people across

jobs or in and out on vacations you're going to be able to establish some patterns there that will allow you to

detect behavior based on the presence or absence of certain individuals or circumstances

then we have compensating controls compensating controls provide options to other existing controls to aid in

enforcement of the gulf so for example let's say your organization requires that personally identifiable information

is encrypted in the database and in fact it is encrypted in the database but someone discovers then that the

the uh pii data is being transferred across the network in clear text so a compensating control

would be for example an additional control to encrypt that data in transit to support the

requirement and you want to make sure on the exam that you you understand

the key element that defines that control type and you know a few examples off the top of your head so you can you

can pick those out uh should you see them in a question so we're actually not done with control types let's keep going

here so so we have corrective controls

corrective controls can range from antivirus that removes uh malicious files to backup software

that automatically restores missing files to policy-based configuration management

that returns a system to its desired configuration after a breach

next up we have recovery controls which are much like corrective controls but they tend to have more advanced

capabilities good examples here would include server clustering vm shadowing hot sites warm sites alternate

processing facilities and finally we have a directive control which is intended to confine or control

the actions of the subject to force or encourage compliance with security policies

good examples of a directive control would be security policy requirement posted notifications

escape route exit signs just to name a few so again make sure you understand the defining

characteristic and you can rattle off a few examples before you walk into the exam

now we're going to talk legal and regulatory which is an area of the cissp exam that requires a lot of memorization

i'm going to try to help you focus that in so at a high level the topics here include cyber crimes and data breaches

transborder data flow licensing and intellectual property requirements things like trademarks

patents we'll talk about that in just a moment privacy is very important quite a few

laws related to privacy and then import export controls which we'll cover also

so let's start by talking about types of law so you have three types you have criminal law which is just what you

think it is it covers areas like assault robbery arson murder you have

civil law which covers more business disputes contract disputes real estate transactions employment estate

the high dollar lawsuit type of law then you have administrative law which relates to government agencies they have

some leeway to enact administrative law that can cover important topics or areas as mundane as requirements when

procuring a phone for an office desk the the cissp exam focuses on security related generalities you're not going to

get into the nitty-gritty details of the law but when a question comes up around health care related information customer

health care information you'd need to know that high tech and hipaa are are laws related to that topic

for example so let's talk about some of the the laws that are likely to come up on the exam

so the computer fraud and abuse act i think the the most significant thing about cfaa was it was the first piece of

u.s cyber crime specific legislation you have federal sentencing guidelines which are laid out to provide punishment

guidelines to help federal judges interpret computer crime laws the federal information security

management act better known as fisma uh had some requirements around formal

information security operations uh for for federal government uh the copyright and digital millennium

copyright act say that three times fast covers literary musical and dramatic work so that that's really helpful for

artists let's talk intellectual property and licensing so you have trademarks which

cover words slogans logos you use to identify a company in its products or services you want to protect your

company name you apply for a trademark patents protect the intellectual property rights of inventors and trade

secrets cover intellectual property that is absolutely critical to a business and must not be disclosed for the health of

that business and then there are four types of licensing you should be familiar with

and that's contractual shrink wrap click through and cloud services

there are some regulations around encryption and privacy that you'll want to be familiar with

so u.s companies cannot export computer technology to certain countries and those include cuba iran north korea

sudan and syria there are also restrictions laid out by the department of commerce that detail

limitations on the export of encryption products outside the us the basis for privacy rights in the u.s

is the fourth amendment to the u.s constitution and gdpr is a law you want to be

familiar with it is not a u.s law it comes from the european union but it is very likely to be mentioned for one very

good reason and that is because it applies to any company with customers in the eu

the us included you're going to hear me mention this a couple of times that's because i do expect it will be on the

exam now let's talk about other u.s privacy laws so you've so when it comes to

health care you have uh health care insurance portability and accountability act better known as hipaa

you have the health info technology for economic and critical health uh better known as high tech

we have graham leech bliley which applies to financial institutions if you see a

question on the exam related to law and financial institutions i'd bet it's going to be graham leach blighly

the children online privacy protection app better known as coppa and the electronic communications

privacy act or ecpa and that's one of two laws related to electronic communications that i might

expect you'd see on the cissp exam the other being the communications assistant for law enforcement act

i think i'd be familiar with both of those as well now notice that i've put the acronyms here i find memorizing

these acronyms makes everything easier because memorizing all those words is a lot of work but if i memorize hipaa when

i see health insurance portability and accountability act i can pick out the h-i-p-a-a right so memorizing those

acronyms is going to make this a lot easier for you and you notice how i talked about just the very basic focus

of these laws you're really going to be dealing with generalities as i mentioned and that's straight from

the official cissp exam prep guide and matches right up lines right up with my experience in taking this exam

so you're going to be expected to be familiar with the business continuity planning process and issues that pertain

to information security in in bcp around things like strategy development processes

plan approval plan implementation training and education so so important you understand the steps

of the process but know that the bcp topics are going to cover you know information security related angles

you're not expected to be a certified business continuity planner here by any means

i'll give you that same warning i give you for any process when you're looking at a process make sure you you know the

steps in order personally i don't think you're going to see a lot about bcp on the the exam it'll be limited

i want to talk through a couple of business continuity planning related definitions worth knowing just to

increase your comprehension of this topic as we prepare for the exam so the business continuity plan is the overall

organizational plan for how to continue business the disaster recovery plan is the plan

for recovering from a disaster impacting it and returning the i.t infrastructure to

operation which of course supports the business and there's a continuity of operations

plan this is the plan for continuing to do business until the i.t infrastructure can be restored i'm not expecting you'll

hear about continuity of operations planned on the exam but it's

it is a thing so i wanted to mention it but let's talk about the difference between business continuity planning

and disaster recovery planning so what exactly is the difference here well business continuity planning focuses on

the whole business it focuses on getting back to doing business where disaster recovery focuses more on

the technical aspects of recovery so bcp will cover communications and process more broadly another way to think of it

is business continuity planning as an umbrella policy and disaster recovery planning falls under that umbrella as

part of the broader plan you want to be familiar with education so security awareness

education and training so the methods and the techniques for different audiences

periodic content reviews evaluating your program effectiveness and

and you can see a variety of questions here that talk about everything from you know simple user security awareness

training to you know what's the the deepest form of training so covering things like classroom training all the

way to degree programs but security awareness training is that topic that is ubiquitous when it comes

to information security so let's start with the consequences of privacy and data breaches the first

being reputational damage when we have a security breach it can certainly result in a loss of customer

trust and ultimately a loss of revenue and the effects may last for years if the situation is not handled correctly

identity theft which involves someone using a person's private information to impersonate that individual

usually for financial gain and if that breach results in data exfiltration were potentially exposing

many people to identity theft if we're losing customer data and if a business experiences

intellectual property theft as a consequence of a data breach they can lose customers credit ratings brand

reputation and they can even forfeit first to market advantage loss of profitability and they might even lose

an entire line of business to competitors or counterfeiters fines so failing to report a breach can

result in fines that can reach into the millions of dollars in fact gdpr outlines fines of up to four percent of

a company's annual global revenues or 20 million euros for failing to report a breach and it may lead to

lawsuits but remember any company with a customer in the eu is subject to gdpr

and let's talk notifications of breaches so if a data breach occurs failing to report that breach as i just mentioned

can result in fines into the millions of dollars the eu sets their standard in gdpr and notification of data

breaches must be reported within 72 hours now escalations to external sources like law enforcement or outside

experts to stop or investigate a breach may well be necessary other countries have their own reporting

time scale and delays may sometimes be allowed for criminal investigation

but we're talking about laws so when in doubt we get the legal department involved

and that brings us to the end of domain one up next is domain 2

asset security i want to touch briefly on what's new in domain 2 because we can expect those new

topics those new areas of focus in 2021 are more likely to come up on the exam we do find certification exams tend to

focus a bit more on what's shiny and new and relevant and here we see 2.3 provision resources securely 2.4

managing the data lifecycle and 2.6 determining data security controls and compliant requirements

drm casbi and dlp those were covered in the 2018 material clearly they've been elevated to some degree

here and in in a world of identity uh focused security and zero trust it's it's not

surprising right our network perimeter doesn't exist as it used to and you're going to hear uh provisioning resources

securely in various capacities through the eight domains managing the data life cycle is the the item i want to call

attention to in domain two so it was mentioned in a phrase in in 2018 it's clearly going to get a little more

attention so here is the data life cycle and you see it begins with creation then story use

share archive and destroy now i want to call your attention to

a similar life cycle that existed in 2018 and it exists in the 2021 version of the course in domain seven in

security operations we have the information life cycle and what you're going to see here are some commonalities

so you'll notice creation you'll notice archival and destruction

use usage and storage what's different here is you notice classification so so the information life cycle it focuses a

bit more on information protection because you don't see classification called out explicitly in the data life

cycle right so another item called out in in domain seven around the information life cycle that's important

for you to remember is there isn't a consistent standard used to identify each stage or phase of

a data life cycle so conceptually speaking what i would suggest you know for the exam is that immediately after

creation it's very important that we classify data because classification tells us the requirements for protection

and the other key elements that i want you to notice here is that each of these cycles includes

archival and destruction right so archival is important because certain regulatory requirements will demand that

we have data that we keep around for a period of time in a retrievable state it could be

a year it could be seven years and data destruction is important because data that remains around longer than is

necessary creates risk and it creates liability it can be stolen it can be called as evidence it can be discovered

as evidence for for legal actions so more than remembering the steps here i want you to remember those key

elements of of the data life cycle of the information life cycle the information life cycle is covered both

in domain 7 and it's also covered in the processes and frameworks video in depth but knowing these will serve you well

but you want to know those you want to be familiar with those practical elements

of of the data life cycle and later here in domain 2 we'll talk about data classification you'll see

this chart so you want to pay attention because data classification is going to have relevance in multiple domains in

the cissp let's start with data security control so

marking labeling handling and classification may well come up on the exam

classification being the most important of these and we'll talk about data classifications in just a moment

uh data handling shipping chain of custody you know remembering don't open boxes

and with data retention comes data destruction we'll talk through some data redestruction methods like erasing

clearing overwriting more on that in a moment and with record retention uh we always need to remember

that that data destruction if the retention policy is one year that data should be destroyed when it ages out so

when it ages beyond one year uh you may even see something related to tape backup this you know this feels like a

legacy concept but it may come up because it exists in the real world and and tape backup security having a secure

facility tapes labeled will ensure that you know everybody understands the classification of the data which really

kind of comes back to that first concept of marking labeling and handling

so let's talk about data destruction methods and you'll definitely want to understand

the difference between these so at a basic level erasing data which is just performing a

delete operation so with erasing you'll want to remember that data is typically recoverable using