CISSP cheat sheet · Domain 7 · 13% of exam
Security Operations
Running security day to day: investigations and evidence, logging and monitoring, incident response, change and patch management, backups, recovery sites and disaster recovery.
Rule cards
| Incident response | Detect → Respond → Mitigate (contain) → Report → Recover → Remediate (root cause) → Lessons learned. Same incident repeating = remediation failed; many different incidents = weak preparation. |
|---|---|
| NIST SP 800-61 | Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-incident activity (Rev. 3 aligns with CSF 2.0). |
| Forensics | Identify → Preserve → Collect → Examine → Analyze → Present → Decide · RAM before disk · never work on the original (bit image + write blocker + hash) · chain of custody throughout. |
| Order of volatility | CPU registers/cache → RAM → swap → disk → remote logs → archival media. |
| Evidence | Relevant + material + competent · best evidence = original · parol evidence = the written contract wins · hearsay ✗ except business records (logs). |
| Backups | Restore speed: Full > Differential > Incremental (backup speed is the reverse) · incremental resets the archive bit, differential does not · 3-2-1 rule · RAID is not a backup. |
| RAID | 0 striping (no redundancy) · 1 mirroring · 5 striping + parity (1 disk) · 6 double parity (2 disks) · 10 mirror + stripe. |
| Recovery sites | Mirror = minutes · Hot = hours · Warm = days · Cold = weeks · recovery team → alternate site (critical first) · salvage team → repairs primary (least critical moves back first). |
| Metrics | RPO = data loss tolerance · RTO = time to restore · WRT = time to verify · MTD = RTO + WRT · MTBF = repairable · MTTF = non-repairable · MTTR = repair time. |
| Ops controls | Least privilege · need to know · SoD (preventive) · job rotation / mandatory vacation (detective) · two-person control for critical tasks. |
| Change management | Request → Impact assessment → Approve → Test → Notify → Implement → Validate → Document. Emergency changes are still documented afterwards. |
| Vulnerability management | Detect → Validate (false positive?) → Prioritise by risk → Remediate · no patch available → compensating control (WAF / virtual patching). |
| e-Discovery (EDRM) | Governance → Identify → Preserve (legal hold) → Collect → Process → Review → Analyze → Produce → Present. |
Hard words made simple
| Term | Simple meaning | Example / analogy | Exam hook |
|---|---|---|---|
| Containment | Stop the spread | Isolate the infected server | First action once an incident is confirmed |
| Remediation | Fix the root cause | Patch the exploited bug | After recovery |
| Order of volatility | Collect what disappears fastest first | RAM before disk | Never pull the plug first |
| Chain of custody | Record of who held evidence, when and why | Courier tracking for evidence | Gaps = inadmissible |
| Write blocker | Device that prevents changes to the original disk | — | Preserves integrity |
| Legal hold | Order to keep data for litigation | Do not delete those emails | Overrides retention |
| Spoliation | Destroying evidence | Deleting held data | Illegal |
| SIEM / SOAR | Collect + correlate logs / automate response playbooks | Alert → host auto-isolated | Automated response → SOAR |
| Threat hunting | Proactively search for hidden attackers | Assume breach | Proactive, not alert-driven |
| Sandbox | Isolated place to detonate suspicious files | Attachment tested before delivery | Unknown malware |
| Honeypot | Decoy system to attract attackers | Fake vulnerable server | Enticement, legal |
| Electronic vaulting / remote journaling | Bulk backups sent off-site / transaction logs sent continuously | — | Journaling = transaction level |
| Parallel test | DR site runs alongside production | Both run; compare results | Critical system, no disruption |
| Non-adversarial event | Disruption with no attacker | Power cut, flood, hardware failure | → DR / BCP thinking |
| UPS vs generator | Battery bridge (instant) vs fuel power (starts after outage) | Inverter vs diesel genset | Zero downtime → UPS |