CISSP
Domain 7 · 13%
Security Operations
The day-to-day running of the security function: watching for trouble, responding when it happens, keeping the lights on when things fail, and doing all of it in a way that holds up in court if it has to.
Investigations and evidence
- Chain of custody — an unbroken, documented record of who handled evidence, when, and why; break it and the evidence may be inadmissible.
- Order of volatility — collect the most fragile evidence first: CPU registers/cache → RAM → network state → running processes → disk → backups/archives.
- Evidence types — real/direct, documentary (needs authentication), testimonial, and demonstrative (illustrates a point, e.g. a diagram).
- Investigation categories: administrative, criminal, civil, and regulatory — each has a different burden of proof and different rules for evidence handling.
Logging and monitoring
SIEM aggregates and correlates logs from across the environment to surface events a single log source would miss. Key operational concepts: clock synchronization (NTP — without it, correlating events across systems is unreliable), log retention (driven by both investigative need and regulatory requirement), and UEBA (User and Entity Behavior Analytics — baselines normal behavior to flag anomalies, e.g. impossible-travel logins).
Incident management lifecycle
The standard six phases (NIST-aligned): Preparation (plans, tooling, training, before anything happens) → Detection (identify a possible incident) → Response/Containment (limit the damage — short-term isolate, long-term eradicate root cause) → Mitigation/Eradication (remove the threat entirely) → Reporting/Recovery (restore normal operations, verify) → Remediation/Lessons Learned (post-incident review, feed fixes back into the program). Note "detection" is distinct from "response" — a very common exam distractor pairs the wrong action to the wrong phase.
Preventive, detective, and corrective controls
Classify any control by when it acts: preventive (stops it — firewall rule, MFA), detective (notices it happened — IDS, audit log), corrective (fixes the damage after — restore from backup, patch), deterrent (discourages attempt — warning banner, visible camera), compensating (an alternative control when the primary one isn't feasible), and recovery (restores full capability after a major event, broader than corrective).
Patch, vulnerability, and change management
Vulnerability management is a continuous loop: scan → prioritize (severity and exploitability/exposure, not CVSS score alone) → remediate → verify. Change management requires a formal process — request, impact assessment, approval (change advisory board), testing, implementation, and a rollback plan — specifically so that "fixing" one thing doesn't silently break availability or introduce a new vulnerability elsewhere.
Business continuity and disaster recovery operations
Building on Domain 1's BIA/RTO/RPO: backup strategies — full, incremental (fast backup, slow restore, needs every increment since last full), differential (slower backup, faster restore, needs only last full + last differential). Alternate sites, in increasing cost and decreasing recovery time: cold site (space and power only) → warm site (partially equipped, hours to days) → hot site (fully mirrored, minutes) → mobile/cloud site (elastic, increasingly the default). A DR plan that has never been tested is a hypothesis, not a plan — test types range from a tabletop walkthrough (cheapest) to a full interruption test (most realistic, highest risk).