CISSP OIG v2 第七章

539

7Chapter

Operations Security

Gary McIntyre, CISSP

Contents

Introduction ..................................................................................................... 540

CISSP Expectations ...........................................................................................541

Key  emes .......................................................................................................541

Maintaining Operational Resilience ............................................................. 542

Destruction, Interruption, and  eft ....................................................... 543

Corruption and Improper Modi cation .................................................. 543

Maintaining Resilient Systems ..................................................................... 544

Trusted Paths and Fail Secure Mechanisms .............................................. 544

Redundancy and Fault Tolerance ..............................................................545

Backup and Recovery Systems ..................................................................549

Sta ng for Resilience ...................................................................................551

Protecting Valuable Assets .................................................................................551

Tangible versus Intangible Assets...................................................................551

Protecting Physical Assets .............................................................................551

Protecting Information Assets .......................................................................554

Controlling Privileged Accounts ........................................................................555

Identity and Access Management ..................................................................555

Managing Accounts Using Groups and Roles ...........................................556

Common Roles ........................................................................................557

Managing Security Services E ectively ..............................................................561

Key Operational Processes and Procedures ....................................................568

Archival, Backup, and Recovery Procedures..............................................568

Problem Management ..............................................................................570

Change Management ...............................................................................570

Con guration Management .....................................................................572

Patch Management...................................................................................573

Security Audits and Reviews .....................................................................575

Summary ...........................................................................................................575

Sample Questions ..............................................................................................576

tions security and security operations. Operations security is primarily concerned

with the protection and control of information processing assets in centralized

and distributed environments. Security operations are primarily concerned with

the daily tasks required to keep security services operating reliably and e ciently.

services in its own right.

 ere are four main themes that we will be discussing in this chapter: maintaining

operational resilience, protecting valuable assets, controlling system accounts, and

managing security services e ectively. Each of these themes is fundamental to opera-

tions security, and focusing on them will help you to navigate the questions that you

are likely to see in the exam.  e CISSP candidate will be expected to be fully familiar

with these themes and know how they apply in a variety of scenarios.

Security operations are expected to provide day-to-day protection for a wide variety

setting strategy or designing appropriate security solutions. At a minimum, they

will be expected to maintain the controls that have been put into place to protect

sensitive or critical resources from compromise.

processes that are put into place to ensure service consistency.  ese include key

service management processes common to most IT services such as change, con g-

such as user provisioning and Help Desk procedures. In today’s security operations,

there is also considerable focus on reporting and continuous service improvement

steady, and reliable service. As a security professional, it is frequently your role to

potential disclosure.

Malicious, unintentional, and uncontrollable irreparable damage can result in the