welcome to my cissp exam cram series this is the complete course we'll call it the 2022 update we're covering all

eight domains of the cissp exam as well as my recommended exam preparation strategy incorporating multiple learning

techniques to help you prepare more quickly and effectively and as a cyber security strategist for

organizations around the world and a chief information security officer for a regional bank and an educator i can

promise you i use the knowledge i gained in the cissp exam every day more importantly for you last

year alone i helped thousands achieve cyber security certifications including the cissp all without expensive boot

camps and that is quite simply my goal to help you get further faster in your exam prep

so we'll be focusing on the key points of every topic we won't spend time speaking unnecessarily

about any topic we're going to focus on the key characteristics of each concept that will help you identify right and

wrong answers quickly on exam day this content utilizes several proven learning methods that have worked for

many candidates before you myself included to accelerate your progress and i will share the techniques that you can

apply in your study on your own i want to speak for a moment about my pace i intentionally speak at about 115

to 125 words a minute if english is not your first language this may be just right for you

if you do speak english as a first language you might find that increasing the speed to 1.25

may be better for you whatever works for you i just wanted to make you aware of that small detail

and by design i'm not focusing on every single topic that appears in the official study guide i'm focusing on

high probability exam topics high difficulty concepts frequent sources of questions from my

exam candidates and areas that require process memorization at the end of the day i want to direct your focus to the

high probability high difficulty areas so you're optimizing your prep you're making the best use of your exam study

time and this strategy has proven to work out well for exam candidates thus far and in

this update i'm simply turning the knobs a bit tuning this strategy further to make it a little bit better still

but in terms of what we're covering in this video we're going to talk about my

recommended exam prep strategy so the techniques that i suggest you use that many candidates before you have used

that i myself have used to prepare for the cissp exam more quickly and effectively we'll touch on domains one

through eight so every domain of the exam and i will also offer a few separate shorter videos to drill down on

what students report to be the most challenging areas and i will call those out at the appropriate points in this

video anywhere i can there's a table of contents in the video

description so at any point if you should want to skip ahead to a specific topic a specific domain feel free to do

that and as with all of my videos you'll find a pdf copy of this presentation

available in the video description you can click and download no sign in required

and a link to additional resources faqs exam updates and errata if there is any will be in the description beneath the

video and you can't be the first to benefit from this material but you may be the

next and i wanted to just share what a few other learners have said amongst the many testimonials we've seen

throughout the last year and while no course is perfect i wanted to give you a comprehensive study

resource and system without the hefty price tag and if we look at the eight domains of

the exam between the 2018 and the 2021 releases you'll see that the same eight domains are present in 2021 as were

there in 2018 and the weighting of these domains has changed very little as you can see here

if i were to describe the updates in the 2021 release of the cissp i would say the updates are incremental

the new syllabus is not that much different from the earlier versions you'll find there's no change in

experience requirements or the number of domains the content in subdomains of course has been expanded to keep up with

the changing times that's no surprise there's almost no change in domain weights as you saw

if you happen to live in a country where you don't get the new computer adaptive testing or

cat exam you'll find that the linear exam which is 250 questions and six hours long has not changed and there's

no change in the cat exam details which i'll touch on in just a moment and a few new topics have been

introduced in some of the domains to keep up with the changing times i will cover those topics in line as we cover

domains one through eight in this course i want to fill you in on the details of the cat exam format cat stands for

computerized adaptive testing and as of right now march 2022 the exam is three hours long with a hundred to 150

questions the number of questions depends on your performance the exam adapts based on your answer and it aims

for a 50 50 probability that you will get the answer to the next question incorrect so it's going to dial the

difficulty up and down based on your performance and the answers are final there's no going back which is why many

myself included think this makes the cat exam more difficult

you need a seventy percent to pass the exam some of the questions are not scored

they're pre-test unscored questions used for research for future exam changes nothing you can do about it don't worry

about it only pass or fail are recorded and if you fail even one domain you fail

the exam so it pays to make sure that your knowledge is above the passing bar for every single domain in the cissp

body of knowledge as you prepare for the exam i also wanted to tell you about a

recently announced change to the cat exam that's coming in june so the current exam includes 25 pre-test

meaning unscored questions 25 more items will be added to that pool bringing the total to 50 pre-test items

so the exam will then be 4 hours and 125 to 175 questions but no other changes to the

syllabus or content which means no real change in how you prepare for the exam as you are right now

and now i want to take you through my recommended strategy for preparing for the exam if you've seen this before feel

free to go to the video description and fast forward to domain one but if not we'll start with the

materials so i recommend the official exam study guide the ninth edition in its electronic form you'll have access

to a thousand practice questions online as well as a little over a thousand flash cards now and the electronic

version is easily searchable that's why i recommend you get the ebook you can buy it at amazon.com it's a touch over

40 u.s at the current time but do make sure you get the ninth edition which is the

update for the 2021 release of the cissp exam so let's start with the million dollar

question that we see frequently when we're preparing for the cissp and that is

how to think like a manager and i'm going to give you here the short version think like a manager

in five minutes or less so it starts with due diligence versus do care and it's really about knowing

our role so due diligence is practicing the activities that maintain the do care effort that's the

book definition not very helpful is it now the do care definition is doing what a reasonable person would do in a given

situation it's sometimes called the prudent man rule but what you see here right away is that

these two concepts work together that due diligence supports do care and these together will reduce senior management's

culpability their liability when a loss occurs both their liability for their own organization and those

in either direction of their supply chain i want to explain these two concepts to you a bit differently in a

way i think will resonate with you so due diligence and do care can really be looked at in the context of a

decision that line in the middle is our decision so on the left we have due diligence

this is the research the planning and the evaluation that frequently happens before the decision

not always but largely before the decision and due care includes implementation of

security controls operation and upkeep of those controls and reasonable measures to secure our organization and

its resources that's the doing after the decision so due diligence

increases understanding and reduces our risk in a given situation and do care ensures that we take those reasonable

measures as outlined in that prudent man rule so i mentioned that due diligence

happens largely but not always before do care so that evaluation process is a recurring process we need to make sure

that our reasonable measures that we put in place continue to be effective over time so we're going to come back and

reevaluate on a recurring basis through internal and sometimes external audits another way to look at due diligence and

do care that may help you remember these and keep them separate and clear in your mind for the

exam is that due diligence is about thinking before you act and do care tells us that actions

speak louder than words another way we see this labeled is due diligence is do detect the d d

and do care is do correct so one of these is about the research and evaluation and the other about taking

appropriate action so separating these into the before and after in your mind may be more helpful

so let's look at examples of due diligence we have knowledge and research of laws and regulations

industry standards and best practices and on the do care side we have delivery or

execution including reporting security incidents security awareness training and disabling access of users separating

from the company in a timely way and thinking like a manager is all about knowing your priorities so if we look at

our security planning horizons from operational to strategic so operational being short term and strategic being

longer term as a chief information security officer you really deal with risks that are

escalated to the top and you send down the objectives as you see them

in terms of their importance so your focus should really be right up here at the top of the pyramid

at the strategic level you're thinking about human safety business continuity protecting profit reducing liability and

risk and you are passing objectives down to the tactical and operational teams which they will implement in the form of

policy and planning and then actually implementing those recommendations and operating the environment on a

day-to-day basis and one more perspective that may prove helpful is assume that you are in that

organization to advise not to touch so during the exam think of yourself as an outside security consultant advising an

organization you're there to advise on strategy priorities and safety you're not doing you're not laying hands on the

keyboard this may help bring focus to process your role to due diligence and do care now if you're interested in the

long version of thinking like a manager check out my cissp mindset video it's right at half an hour it is the full

story it does also include me walking through a couple of practice questions to show you how you can use this logic

to reason your way to the best answer on exam day now let's take a look at some of those

learning techniques i promised at the beginning of this video the fact of the matter is there is no award for longest

study time whether you prepare for this exam in two weeks or two months or a year and a half

a pass is a pass and so if we can prepare effectively actually learning this content for the long term without

spending a year and a half doing so we should absolutely do that and

the number one reason that i am not a fan of those five-day boot camps where you spend two or three thousand dollars

and then go take your exam on day six is due to the length of time it takes to memorize anything to truly learn

anything i can commit facts to short-term memory you know quickly by repeating my

learning spacing my repetition out over a period of hours in fact with my fifth repetition only including a 48 hour gap

within a week i can commit facts to memory very quickly now to commit something to memory for

the long term to really onboard that for the duration of your career typically takes more time and how much time it

actually takes depends on your level of exposure and experience to these concepts but you can see if you're

starting from scratch to truly memorize anything for a long time can take repetition over a period of days weeks

and even months and there's a lot of power in repetition and i'll show you some techniques that

we can use to repeat our learning in different forms

whether we're working on those short-term intervals or the long-term intervals we call this spaced repetition

and the fact of the matter is between your sessions what you'll find from your first

study session to your second to your third is that with each successive repetition you are remembering for

longer and you are forgetting less information what you'll find is that your forgetting curve we call it becomes

shallower with each repetition using this spaced repetition technique and it's not purely about memorization

we do need to identify our weakest areas and focus our repetition on the topics where we need

work and we'll talk about how to do that in just a moment but at the end of the day our focus is

to understand these concepts not just memorize them studies have long shown that understanding a subject before you

memorize greatly improves your retention because you're not just memorizing words and the exam will assume that you

understand when and where concepts fit you need to be able to apply these concepts in the

right scenarios so one learning technique that makes memorization easier is what we call a

mnemonic device or a memory device and a common memory device is an acronym and i'll show you an example in a moment

but our mnemonic devices are best when they are simple they are relevant to the topic and

visual where we can make them visual so let's look at a couple of examples here so we'll start with a first letter

mnemonic and a good example of a first letter mnemonic is the osi model so back in the

90s i remember memorizing the osi model using a first letter mnemonic please do not throw sausage pizza away that was

layers one through seven and then in the reverse all people seem to need data processing so one could argue that we

could make this more relevant by changing the words in our mnemonic let's try please do not toss security

processes aside whatever works for you but we could argue that's more relevant another mnemonic here comes with the

incident management framework so our acronym here is drm rrl

drum roll if we pronounce it the letters don't spell it out quite right but you see i can add a visual element here as

well to make it easier still for me to remember that framework that process another technique that's useful when

we're dealing with large amounts of information is chunking it's the process of breaking information into smaller

pieces or chunks that make sense so let's take cryptography as an example we have asymmetric cryptography we have

symmetric cryptography hashes block ciphers so we could break cryptography into these chunks for

example and then i can break those categories into smaller chunks yet let's take hashes for example i'll break this

into chunks based on a unique property i find within these so let's take hash algorithms i'll take the

message digest family and i see here that for md 2 4 and 5 they each have a hash value length of 128. i see that by

and large they're not still in use with md5 there are some exceptions to that it's still used with file hashes

but in the cryptographic context not so much let's take the shaw family this is

secure hash algorithm what i notice here right away is that the hash value length matches the name i can see here that

most of these are still in use certainly all of the sha-2 family is still in use but shaw 1 is not that's a chunk

i notice here that the hash value length matches the name of the algorithm that's useful

in rounding out our exam prep strategy i want to talk you through what i call the 80 20 strategy for identifying your 20

weakest area so you can spend 80 percent of your time there so it starts with the practice exams now

whether you get the practice exams from the official study guide or elsewhere doesn't matter so much i'm going to show

you how to use the exams in the official study guide to drill down to your weakest areas on a per domain basis and

that's really the important question here is how can i best use these practice quizzes to assess my exam

readiness because the fact of the matter is if you get to exam day and you ask yourself am i ready if you don't know

the answer to that question then the answer is no and the way i suggest you do this is by

looking at how the book is organized per domain so chapters 1 to 4 in the book for example

map to domain 1 security and risk management chapter 5 maps to asset security

chapters 13 and 14 mapped to domain 5 identity and access management so if we use

the quizzes at the end of these chapters we can focus our learning to find our weak areas in that domain

and one of the more common questions i receive is how do i get access to those online resources that are promised in

the book so if i just go to the electronic copy of the book i'm going to search for test

bank one word and that will bring me to the section here that describes the interactive online learning environment

and test bank and you're instructed to go register at wiley.com you'll be prompted with a challenge you can only

answer if you've purchased the latest copy of that book and once you sign in to the website

you'll be presented with a page similar to this i'll find the cissp i'll

log in there and ultimately i come to a page that looks just like this it's efficientlearning.com

and when i log in here i've gone through the process of registering

i'll see the products that are available to me and i can go to the test bank so what you need to know here is that

with these 1000 questions they are divided into exams in the quiz builder

but we can customize entirely so what i'll do is uncheck question topic so i've unchecked all questions and if i go

into those chapters i can select specific chapters to create a custom quiz so for example chapters

one through four i mentioned were domain one i will select just those four chapters

i'll scroll to the bottom and here i can tell the wizard the number of questions i'd like

so i want all 80 questions and now i can take a quiz that is only focused on domain 1 which is covered in chapters 1

through 4. and on that same screen where i selected the

test bank the practice quizzes you'll also see an option to select the flash cards

but i commonly find candidates get into the test bank here and they can't quite figure out how do i take a quiz that

shows me my weaknesses in a particular domain well that's how you do it you map the chapters out as you see here and

again you can download this as a pdf so you'll have this information at your fingertips

so moving through the 80 20 strategy as we go through that spaced repetition we have our practice exams that will help

us understand our weak areas which will spur some targeted reading we'll go read a little more on those topics where we

have weakness to better understand the material we'll come back and review the powerpoint in this video and some of the

other targeted drill down videos i have we'll look at live quiz or flash cards

so the flash cards are great if you don't have a partner to help quiz you for example my spouse my wife helped

quiz me as i was preparing but if you don't have a partner then you can use those flash cards to quiz yourself

on those topics but at the end of the day research has proven that we all function best when we learn using a

variety of techniques so variety is the spice of life and it is very effective in learning subjects more quickly

and there you have it that's my system which means it's time for domain one which is security and

risk management now a few key areas you'll be expected to know for domain one include risk and risk analysis

you'll be expected to know the quantitative risk analysis formulas and how to apply them

threat modeling concepts and processes and the frameworks that go with that compliance legal regulatory and privacy

you'll be expected to have some summary knowledge of particular u.s laws and in the case of the eu gdpr a european law

that applies to u.s companies professional ethics you'll need to know the isc squared code of ethics by heart

security governance principles like itil and finally security policies standards procedures

and guidelines you'll need to know the difference between these four including which are suggested and which are

mandatory in terms of what's new in domain 1 in 2021 when we break down the

exam syllabus 1.1 is now understand adhere to and promote professional ethics i would say generally speaking

this is a non-event there's fundamentally no change from 2018 in terms of what you'll be expected to know

for domain one so i mentioned you're going to need to know

the cia triad by hearts the cia stands for confidentiality integrity and availability you'll sometimes see this

expressed visually in the form of a triangle with confidentiality being the first followed by integrity and

availability so confidentiality is about secrecy or privacy and in the technology context

that means access controls that help ensure only authorized subjects be those people or services can access objects

whether that object is data or a system so integrity ensures that our data or system

configurations are not modified without authorization if a threat actor modifies data without

authorization we've now lost integrity that data is now no longer true and reliable

and confidentiality and integrity don't matter if we don't have availability so authorized requests for objects those

systems that data must be granted to subjects within a reasonable amount of time

the cia triad is covered in chapter one of the official cissp study guide you'll want to know cia very well for the exam

definitely going to come up i mentioned the cissp code of ethics i'm not going to read you the full

code here but at a high level it covers protecting society infrastructure the commonwealth acting

in a manner that is honest and responsible and legal providing competent

service to others and to advance and protect the

profession the code of ethics itself is much longer than this you want to give the whole thing a quick read and

personally i find most of what's in here is common sense but but you'll want to have some

familiarity with the terminology they use in here in case it comes up on a question

so i want to shift gears and talk about security policy development so at a top tier security policy is your document

that defines the scope of security that's needed by your organization the assets that need to be protected and to

the extent we should go to to protect them but there are four levels of security policy

development so it starts with acceptable use policy which is designed to assign roles within an organization and to tie

responsibility to those roles then we have security baselines which define a minimum level of security that every

system in the organization needs to meet then we have security guidelines which offer

recommendations on how standards and baselines should be implemented and these provide operational guidance for

both our security professionals and our users and then finally we have procedures

which are those detailed step-by-step documents that describe the exact actions that are necessary to implement

a specific security mechanism a control or a solution in protecting our data or infrastructure

so tidbit for the exam when you're developing new safeguards you're establishing a new baseline a new

security baseline which means that maintaining compliance with existing baselines is not a valid consideration

point now let's move on to risk management and risk analysis and i want to start with risk category so a

category is a group of potential causes of risk so at a high level you have damage which results in physical loss of

an asset or an inability to access that asset and then when it comes to information we have disclosure and

disclosing critical information regardless of where or how it was disclosed if this was a malicious act as

a result of a threat actor or unintentional on the part of a well-meaning user

and we have losses so losses might be permanent or temporary which could include altered data or inaccessible

data so data altered without authorization affects integrity if we think about it from a cia perspective

and then if you think of an attack like ransomware for example which renders data inaccessible

and permanently inaccessible unless we can recover and then we have risk factors and risk

factors factors are something that increase risk or susceptibility to loss

so in the realm of risk factors we have physical damage natural disasters power loss vandalism we have malfunctions so

whether that's a failure of a system or a network or a peripheral or the hvac system we have attacks now these are

purposeful acts of of a threat actor whether that's from the inside to the outside like unauthorized disclosure for

example so continuing on risk factors human errors now these are usually considered

accidental incidents where attacks are generally purposeful incidents then finally we have application errors which

would be failures of the application including potentially the operating system

now security planning may come up on the exam and there are three types of plans you need to be familiar with the first

is the strategic plan this is the long-term plan that's fairly stable it should generally include a risk

assessment and the strategic plan typically has a five-year horizon and you'll update it annually this helps to

align the goals of the security function with the organization's missions and objectives

the next one is the tactical plan this is a midterm plan it's developed to provide a little more details on the

goals of the strategic plan this is typically going to have a horizon of about one year the tactical plan gives

us a little more flexibility we can make some ad hoc adjustments here when circumstances dictate and the final plan

of the three is the operational plan so this is a short-term highly detailed plan that drills down on the strategic

and the tactical plans and by short term we're typically talking about monthly or quarterly the

operational plan will have budgetary figures staffing assignments scheduling and typically step-by-step

implementation procedures so now let's talk about response to risk so we have several ways we can respond

to risk the first is risk acceptance and and that means simply doing nothing we simply accept the risk

and the potential loss if the threat occurs and if the safeguards or counter

measures outweigh the potential loss in terms of their cost then just simply accepting a risk might make sense

the next option is risk mitigation or sometimes you'll hear this called risk reduction and when we mitigate risk we

implement uh countermeasure and we accept the residual risk that's the risk that's left over

once our safeguards our security controls are in place

now in risk assignment this is also called risk transference we're transferring or assigning that

risk to a third party like in purchasing insurance against damage and outsourcing to companies with

specific expertise is another way we commonly see risk assigned or transferred

so next is risk avoidance so when the cost of mitigating or accepting a risk are higher than the benefits of the

service itself then avoidance is a good idea so for example

i might decide to locate a business in kansas instead of florida to avoid hurricanes if i decide that the cost of

mitigating the risk of hurricane damage to my business is too great so continuing down this road risk

deterrence is another potential response and implementing deterrence to would-be violators of security and and policy

is a pretty common response in the real world and deterrence would include things like

implementing an audit policy to deter folks from malicious behavior for example in the

i.t department security cameras are security guards to defer deter

unauthorized entry onto our premises or even something as simple as warning signage

and then finally we have risk rejection and i want to point out this is generally considered an

unacceptable response it's a possibility but it's not acceptable this means to simply

reject or or ignore the risk just treat it as it doesn't exist

obviously never a good idea to just bury our head in the sand because problems don't just go away

but remember handling risk is not a one-time process this is an area you're going to have to revisit on a recurring

basis and refresh your responses to risks and to determine if the nature of these risks has shifted in

some way and require changes on your part let's talk about

risk management frameworks now the primary risk management framework referenced on the cissp exam

is the nist 800-37 framework and that's currently in revision 2.

if you'd like to read it end to end i'll have a link to 800-37 in its latest revision down in

the description for this video now you'll also hear some other risk management frameworks mentioned but i

want to point something out here so from the cissp study guide it says consider the following risk management frameworks

for use in the real world so the key there is for use in the real world so they mention octave and fair

and tara and the fact that they say consider these for use in the real world while mentioning

that nist 800-37 is the primary framework that tells me i'm not going to worry much about these i'm going to

focus on nist 800-37 now this nist framework establishes a

process steps and you with any process in cissp you need to make sure you know these steps in order and really it's

depicted by some as a preparatory step followed by six main steps i'm going to just give you the

seven steps so when we talk about that preparatory step uh preparing to execute

the risk management framework is that preparatory step so so if you ever see nist 837 presented as six steps it's

because they leave the prepare off so second step is categorizing your information systems

and we're looking at the information process stored and transmitted by the system based on analysis of the

potential impact for loss next is selecting security control so we need an initial set of controls for the

system and to tailor those controls to our reality to reduce risk to an acceptable level

based on our risk assessment step four we implement security controls and we describe or document how those

controls are employed within our systems and our environment and then we're going to assess those controls to determine if

they're implemented correctly if they're operating as we intended in our environment and most importantly are

they producing the desired outcomes are they meeting our security and privacy requirements and expectations

so next we authorize the system and by that i mean we authorize the system to operate in a normal

environment and at that point the organization is accepting the risk formally

for the system and because this is not a one-time event your risk management is a

process uh step seven is monitoring our security controls

periodically assessing that our controls are effective documenting any changes to the system and

conducting risk assessments periodically as necessary and remember i mentioned this is a

process right for any process in cissp we need to know those steps we want to know them in order some folks will use

a mnemonic device or a memory device that's called using the first letters of these steps in the framework

so for example for for these letters for pcs i am i could use the mnemonic device people can see i am always monitoring

so at test time if i'm a little foggy on nist 800-37 i can at least get the first letter of each of these seven steps by

remembering my mnemonic device people can see i am always monitoring that was something we did very commonly

with the osi model back in the day and we'll talk about that in a later domain in this series

and a few other things for the exam so do remember when you're talking about risk management and and risk analysis

not every risk can be mitigated that's just a fact and it's management's job to decide how

that risk is handled so when you hear me talk about thinking like a manager when you're taking the

cissp exam remember it's the role of a security professional to be a risk advisor to advise the decision maker who

is the manager and also when multiple priorities are present always remember human safety is

the most important i bring that up now that it may not even come up as a part of this domain but it's an important

point so i wanted to just mention it early on here left i i forget

remember to prioritize human safety when you're presented with many options and remember when legal issues are involved

calling an attorney is a valid choice it might not seem like a valid choice because it's technical folks

you may want to solve every problem but when we put our manager hat on calling an attorney is a great

example of risk transference right or or assignment we're

outsourcing our problem to an expert so let's talk for a moment about types of risk so residual inherent and total

are three types of risk

so we have residual risk which is the risk that remains even when

all our conceivable safeguards are in place that's the risk we can't get rid of

and at that point the risk management function has chosen to accept rather than to to mitigate or transfer or

assign that residual risk sometimes there's a bit of risk there we just can't shake

so we're accepting then there's inherent risk newly identified risk not yet addressed

with risk management strategies so another way of saying that is its inherent risk is risk that exists in the

absence of controls and this is one that that you don't really see in every cissp text i bring

it up because i've seen it a time or two and it's worthy of mentioning but total risk is the other that you want to be

very familiar with and that's the amount of risk an organization would face if no safeguards were implemented so

to say it another way if we just look at those three types of risk residual risk is after

controls are implemented that's the risk that remains inherent risk is risk that exists before we've implemented our

safeguards and then total risks would be the risk present without any safeguard so for the

exam you really want to focus on residual risk and total risk these are going to come up in a formula

and this is the first time i've mentioned formulas but formulas are very much a thing when we talk about

risk analysis and management on the cissp exam so a few tidbits for the exam

so be able to explain total risk residual risk and the controls gap which is the amount of risk that's

reduced by implementing safeguards we'll see controls gap in a formula and talk about that a bit more a little

later in this installment so to calculate total risk know this formula threats times vulnerabilities

times asset value equals total risk and we'll look at some of these formulas later in this installment because you

will need to understand the several formulas as they relate to to risk

and how to use them to arrive at good decisions so we can also express risk itself

as a formula and risk can be defined as as threat times vulnerability so yes you know threat and vulnerability are

expressed as numeric values as probabilities so stick with me to the end of the video

we'll we'll see more formulas here and we'll we'll look at a couple of examples to help you get the ball rolling

and if when we're done if maybe you'd like to see a video dedicated to nothing but the formulas that are going to come

up for you on the cissp exam just leave me a comment and

i can make that happen so i want to shift gears now from risk to risk analysis so so there are two

ways at the highest level to evaluate risk to our assets there's qualitative risk analysis and quantitative risk

analysis so quantitative assigns a dollar value to evaluate the effectiveness of our

countermeasures quantitative risk analysis uh really is the more labor-intensive of the two

methodologies it employs typically a lot of data collection and analysis using cost benefit analysis

it results in specific values that we're really what we're doing is removing guesswork

and opinions from the process it's really if if i were to describe quantitative risk analysis in one word

it's objective it requires a lot of information and effort typically but at the end of the

day it's going to assign a tangible dollar value so we can evaluate the effectiveness of our

response to risk so let's look at the risk analysis steps involved in quantitative risk analysis

so this is specific to quantitative risk analysis we're going to talk about qualitative in a moment

so step one is inventorying your assets and assigning a value and you might be asking yourself what's

that out what's that text out there in red i'm putting some some terms and some acronyms out here because these are

going to come up in formulas that we discuss later in this module so these are going to be important you'll wind up

revisiting this slide to to perhaps think think again through

these steps and and what the outputs of the step are so step two we're identifying threats

we're going to research our assets we're going to produce a list of all the possible threats to each asset

and here we're going to calculate ef which is the exposure factor and the sle which is the single loss

expectancy we're going to get to what these mean in just a moment i just want to set the stage for you so you know

what some of these outputs are and this will all come together when we talk about the formulas

step three you'll perform a threat analysis to calculate the likelihood of each threat being realized within a

single calendar year you're calculating the annualized rate of occurrence again that acronym is going to show up in a

formula here momentarily step four we're going to estimate the potential loss by calculating the annualized loss

expectancy and the fact that the word annual or the concept of yearly is coming up here

should tell you that this process is an ongoing process right this is a recurring process we're going to

revisit periodically within our organization it's not a one-time exercise step five we're going to

research counter measures for each threat and then we're going to calculate changes to the annualized rate of

occurrence so in other words how often is is this event going to occur

and what is our annualized loss expectancy based on the counter measures that we've applied

so if we've done our job right the the annualized rate of occurrence and the annualized lost expectancy are going to

be lower than when we started in step six we're going to perform a

cost benefit analysis of each of our countermeasures for each threat for each asset

to determine in a very dollars and sense fashion if we've made good decisions in our selection of countermeasures

so let's talk about qualitative risk analysis so qualitative risk analysis uses a scoring system to rank threats

and the effectiveness of our countermeasures relative to the system and the

environment it requires guesswork and estimation it definitely uses opinions however

it does provide meaningful results if i if i could summarize qualitative risk analysis in one word it would be object

subjective because it involves opinions and while it's going to tend to be less accurate it is a quick way we can make

some estimations that we can then use to guide our efforts in the deeper quantitative risk analysis so so a lot

of times qualitative risk analysis can serve as that way we take a five minute rough cut at the problems we're dealing

with i can rank impacts as low medium high i can throw out some percentages

to just get to a point that i know what i'm dealing with in terms of the probability and impact of of the threats

we're working with of the the risk we're trying to to deal with uh you should be familiar

with the delphi technique for the exam as well so in qual qualitative risk analysis this is uh basically anonymous

feedback and response used to arrive at a consensus a couple of other considerations when it

comes to risk analysis uh there's lost potential so so what would be lost if the threat agent is successful in

exploiting a vulnerability and then delayed loss and this is the amount of

loss that can occur over time because the reality is you don't lose

everything all at once in certain situations for example if an exploit

takes down your firewall and from in front of your web farm and your web farm is unavailable you

lose money over time as customers can't reach your website that's delayed loss and i mentioned threat agents here the

threat agents are what cause the threats by exploiting vulnerabilities the vulnerabilities are

the weaknesses in your assets or in your safeguards for that matter so i promised you we would talk about

those important formulas and that time has come so we're going to talk about the relevant

terms and the formulas that we use to calculate their results

so we have exposure factor single loss expectancy annualized rate of occurrence

annualized loss expectancy and safeguard evaluation so these all factor into

some key formulas that are definitely going to show up on the cissp exam so let's dig into these terms and the

formulas that go along with them so we'll start with exposure factor ef this is the percentage of loss that an

organization would experience if a specific asset were violated

by a realized risk so this is a percentage of loss so so ef or exposure factor is expressed as a percentage

single loss expectancy or sle so this represents the cost associated with a

single realized risk against a specific asset so this gives us

a one-time loss figure so the formula for single loss

expectancy is the asset value times the exposure factor so the asset

value is going to be a number a dollar figure the exposure factor will be a percentage which is expressed as a

decimal when we're doing the math so let's look at a sample here so if i

have an asset value on the left here of a hundred thousand dollars and a tornado is estimated to do thirty percent damage

to my asset so that's going to be point three my exposure factor is thirty percent

uh and my single loss expectancy then would be 30 000 or the asset value times

the exposure factor okay this is just the tip of the iceberg so let's keep going here

so annualized rate of occurrence or aro so this is the expected frequency with which a specific threat or risk will

occur within a single year so the annual rate of occurrence is an

important input for this next item

and that is annualized loss expectancy so this is the possible yearly cost of all instances of a

specific realized threat against a specific asset

so we look at that in a formula the the annualized lost expectancy the

ale is the single loss expectancy

times the annual rate of occurrence so so the sle is the one time uh loss

and then we take that times the annualized rate of occurrence so if we have an sle of 50 000

and we have an annualized rate of occurrence of say 0.5 because a particular threat only

occurs once every two years 50 000 times 0.5 is 25 000. so i've explained that simply there but

i started with an sle we'd already calculated let me take you through an end-to-end example of annualized loss

expectancy so we have an office building that's worth two hundred thousand dollars

and we estimate that hurricane damage uh would be fifty percent uh of the value of this building

and hurricane probability is one every ten years so ten percent or point one okay so we have to start by calculating

the single loss expectancy right so the single loss expectancy is the two hundred thousand dollar building times

the damage estimate of fifty percent or point five so our sle

is one hundred thousand dollars now we're going to take that sle and that factors into

our ale equation so we'll carry that hundred thousand dollars into the next equation here and that is the

single loss expectancy of a hundred thousand dollars times

the annualized rate of a current or aro and our hurricane probability is one

every 10 years so the annualized rate of occurrence is 0.1 so so if a hurricane probability was one

every single year that would be one even right but one every ten years means point

one so we take that hundred thousand times point ten and our annualized loss expectancy

is ten thousand dollars so what this tells us is that the safeguards we put in place

better not cost more than ten thousand dollars a year or we're spending more to protect this building than we're

essentially going to save so that gives us the the value of the safeguard so while

we're on that subject that that gives you a dollars and cents answer right so while we're on that subject let's

talk about how the value of the safeguard is expressed then so we call that

safeguard evaluation so good security controls will mitigate risk they're transparent

to users they're difficult to bypass but the last one here they're also cost effective so in our previous example we

saw that the safeguard shouldn't cost us more than ten thousand dollars a year or we were spending too much

relative to the reduction in loss so so safeguard evaluation has a formula so

it's the annualized loss expectancy before the safeguard minus the

annualized loss expectancy after the safeguard minus the annual cost of the safeguard

that gives us the value of the safeguard so we're really trying to answer the

question is the safeguard cost effective if we're spending more to protect an asset

than we're saving in ale then we don't have a cost effective answer there so there's your formula

expressed a little more simply so ale before the safeguard minus ale after the

safeguard minus the annual cost of

the safeguard so again i hope these examples have been helpful if you need more help with formulas if we need to do

a video with just the formulas go down to the comments drop me a note let me know we can make it happen

so the amount of risk reduced by implementing safeguards is known as the controls gap

and to see control's gap in a formula we can look at residual risk then so residual risk is total risk so

the risk and absence of controls minus the control's gap gives us that remaining

or residual risk so if total risk is a hundred thousand dollars the

controls gap is fifty thousand dollars our residual then is fifty thousand dollars

and the expectation that you know all of these formulas and how to use them make quantitative risk analysis one of the

most difficult topics on the cissp exam so one of the most important videos you can watch is my quantitative risk

analysis just the formulas video where i walk you through a real world example where we apply

those formulas to a realistic use case you'll find a link in the video description

the cissp exam will also test your knowledge of applying risk-based management concepts to the supply chain

so today most services are delivered through a chain of multiple entities that is to say

one product like a car for example really you know while it has a car company's

label on it likely includes components from multiple companies and certainly

may be transported by multiple companies to the dealership so a secure supply chain includes

vendors who are secure they're reliable they're trustworthy they're reputable and

you need to evaluate the vendors in your supply chain to ensure that's true so when evaluating third parties in the

chain you want to consider methodologies like on-site assessment visiting an organization interviewing personnel and

observing their operating habits to ensure they are as safe as they claim to be

document exchange and review and this means to investigate the means by which this organization

exchanges data sets and documentation as well as the formal processes by which they perform assessments and reviews

there's processor policy review so requesting copies of their security policies their

processes or procedures and you could finally

opt for a third-party audit so having an independent auditor provide an unbiased review of an entity security

infrastructure our next topic is one where i suspect you'll have some memorization ahead in

order to be prepared for exam day and that is threat modeling which can be proactive or reactive but the

goals are are to eliminate or or at least reduce threats significantly and your threat modeling approaches

can take one of three common forms they can focus on assets where asset valuation

is is used to identify threats to valuable assets we want to to focus our our spending on assets that

have value to the business right focusing on attackers is another common approach where

the the process is focusing on the attacker's goals and then finally

focused on software where considerations center on potential threat against the software the

organization develops or implements so let's talk through a few of these models remembering that they can focus on

assets attackers or software so one of the

more common threat modeling frameworks and it's mentioned in the cissp is stride which was actually developed by

microsoft so so remember that in case it gets called out as a detail in a question

so the stride model focuses on the the potential threat so spoofing

tampering repudiation information disclosure

denial of service and elevation of privilege so because these were developed by

microsoft we see this as a software focus right it's focused on potential threats

to to software and i believe most of these are going to be pretty well known to you repudiation

might be a term that you're not super familiar with and that's the ability of a user or an attacker to deny having

performed an action or an activity and that often takes the form of the attacker staging the situation to

blame someone else and then there's spoofing that involves falsified identity tampering which is

data manipulation you know restaurant transit but remember stride is developed by

microsoft and remember the terms there that uh that map to the acronym right all right so moving on in the threat

modeling discussion let's talk about pasta which focuses on developing counter measures based on asset value

and there are seven stages of pasta but the key here it's a

threat modeling approach that focuses on asset value which really gets to the heart of the

matter right because when we're dealing with with risk management it really comes down to

implementing cost effective control so when we're modeling threats focusing on asset man

on asset value is a great idea okay moving on there's the vast threat modeling approach which

stands for visual agile simple threat so this is based on agile project management principles

so the bottom line goal of vast is to integrate threat management into an agile

programming environment so next up is

the dread model which is based on the answers to five questions so damage potential so how severe is the

damage likely to be of the threats realized reproducibility so how complicated is it

for attackers to actually reproduce to implement the exploit exploitability so how

difficult is it to perform the attack affected users this is really about headcount right how many

users are likely to be affected by the attack as a percentage and that could mean

internal users and that could mean you pay the bills users your customers

and then discoverability so how difficult is it for an attacker to discover this

weakness because a significant weakness five or six layers deep in our defense and depth

may not be such a big problem for us so certainly something we might want to

address but maybe we'll will push it down the priority list so rounding out our our threat modeling

discussion is the trike model which focuses on acceptable risk it's an open source threat modeling process that

implements a requirements model that essentially ensures the assigned level of risk for each asset as acceptable to

stakeholders so remembering that trike is risk focused and it implements a requirements model

should cover you if it comes up on the exam and to round out domain one i want to talk to you about

cobit which stands for control objectives for information and related technology it's

not a great mapping to the cobit acronym frankly and this is a security control framework sometimes

described as a framework for i.t management and governance it's based on five principles so meeting stakeholder

needs covering the enterprise end to end so treating our our enterprise

as as the full scope of our focus applying a single integrated framework

so so continuity of a centralized coordinated approach enabling a holistic approach

and separating governance from management so holistic approach and separating governance from management

are key concepts or i think and we're expecting to see little or no coverage

on the cissp exam in fact the official study guide mentions it only briefly and goes on to promise that there's

going to be no real depth of coverage on the cissp exam so this should get you through with the basics around

cobit an important aspect of threat modeling you may not be acquainted with yet is

diagramming potential attacks so determining potential attack concepts is achieved

through visualizing your infrastructure and identifying threats