CySA+
  • CySA+ CS0-002 Exam Objectives
  • Threat Intelligence Cycle
  • Intelligence Sources
  • Security Intelligence Sharing
  • Threat Classification and Threat Actors
  • Threat Research and Indicators of Compromise
  • Attack Frameworks and The Cyber Kill Chain
  • Defining Threat Modeling and Threat Hunting
  • Vulnerability Identification and Validation
  • Vulnerability Scan Results and CVSS Scores
  • Nmap and Enumeration
  • Security Controls
  • Defense in Depth Security Baselines
  • Security Trend Analysis
  • Remediation Issues
  • Asset, Change, and Configuration Management
  • Software Development Lifecycle & Development Models
  • Software Assessment and Code Review
  • Mitigating Attack Types Part 1
  • Mitigating Attack Types Part 2
  • Mitigating Attack Types Part 3
  • Password Cracking and Hashing
  • Privilege Escalation & Man-in-the-Middle
  • Network Based IoCs
  • Host Based IoCs
  • Network Architecture and Segmentation
  • Network Traffic, Packet, and Protocol Analysis
  • Pentesting and Active Defense
  • Firewalls
  • URL Analysis & DNS in Malware
  • Network Access Control and Port Security
  • Identity and Access Management (IAM)
  • Web Application Scanners
  • SSL/TLS Digital Certificate Management
  • Mobile Threats
  • Email Threats and Mitigation
  • Data Loss Prevention (DLP)
  • Endpoint Security and Behavior Analysis
  • Hardware Assurance
  • Blackholes and Sinkholes
  • IoT, Embedded Systems & ICS/SCADA Threats
  • Log Analysis & Continuous Security Monitoring
  • SIEM and Event Correlation
  • Malware Analysis
  • Cloud Models and Service Threats
  • Cloud Automation and Other Cloud Threats
  • VDI, Containers, and Microservices
  • CI/CD, IaC, DevOps
  • AI and Machine Learning
  • Digital Forensics
  • Technical Controls for Securing Data
  • Non-Technical Controls for Securing Data
  • Security Policies and Procedures
  • Continuity Planning and Risk Assessment
  • Incident Response Phases and Communication
Powered by GitBook
On this page

Continuity Planning and Risk Assessment

  • Enterprise Risk Management

    • Business Continuity

    • Legal

    • Reputational

  • Continuity Plan

    • Disaster Recovery Plan

    • Business Recovery Plan

    • Contingency Plan

  • Risk = Probability x Impact

  • Quantitative Risk Assessment

    • AV = Asset Value (cost to replace)

    • EF = Exposure Factor (% of AV)

    • SLE = Single loss expectancy

      • SLE = AV x EF

    • ARO = Annual rate of occurrence (how often does it happen)

    • ALE = Annual Loss Expectancy (how much do we expect to lose)

      • ALE = SLE x ARO

  • Qualitative Risk Assessment

    • Based on people’s opinions

    • Ask people to estimate the risk using subjective statements such as Low, Medium, High

  • Business Impact Analysis

    • MTTR – Mean time to repair

    • MTBF – Mean Time Between failures

    • MTD – Maximum Tolerable Downtime

    • RTO – Recovery time objective

    • WRT - Work time recovery

    • Recovery point objective – Point in time of backup to restore to.

  • How do we handle risk?

    • Avoidance – just get rid of the function

    • Transference or sharing – insurance. Convert risk to money.

    • Mitigation or remediation – reduce risk to an acceptable level

    • Acceptance

  • Incident Impact

    • High level identification of an incident

      • Category

      • Vector

    • Scope based classification of an incident

      • Organization vs local

      • Anything critical?

      • Number of systems?

    • How difficult is recovery?

    • Immediate vs total impact

  • Risk Assessments

    • System characteristics

    • Threat identification

    • Vulnerability identification

    • Control analysis

    • Likelihood

    • Impact analysis

    • Control recommendations

    • Documentation

    • Objectives: always security for assets (people first)

      • Minimize loss

      • Avoid it happening again

      • Increase stability

      • Avoid liability

    • Planning

      • IR team

      • BIA to assess risk

      • Create procedures, communicate them

      • Test the procedures

PreviousSecurity Policies and ProceduresNextIncident Response Phases and Communication

Last updated 2 years ago