CISSP Domain 7: Security Operations – Comprehensive Review

1. Overview of Security Operations

Security operations focus on implementing, managing, and assessing security controls to protect information assets, detect and respond to security incidents, and ensure business continuity. This domain covers incident management, disaster recovery, investigations, physical security, and resource protection.

2. Investigations and Forensics

Security professionals must understand the different types of investigations and how to collect, preserve, and analyze evidence.

2.1 Types of Investigations

Administrative – Internal policy violations (e.g., HR issues, insider threats).
Criminal – Law enforcement involvement, legal admissibility of evidence required.
Civil – Contractual disputes, lower burden of proof than criminal cases.
Regulatory – Compliance with industry regulations (e.g., HIPAA, GDPR).
eDiscovery – Electronic discovery for legal proceedings.

2.2 Forensic Procedures

Order of Volatility – Collect evidence from the most volatile sources first (e.g., RAM, cache, network data).
Chain of Custody – Ensuring evidence integrity by documenting handling.
Legal Considerations – Following legal procedures to ensure evidence admissibility.
Anti-Forensics – Techniques attackers use to obscure evidence (e.g., encryption, data wiping).

3. Logging, Monitoring, and Detection

Monitoring is essential for detecting security incidents and responding promptly.

3.1 Logging and Monitoring Strategies

SIEM (Security Information and Event Management) – Aggregates logs for real-time monitoring.
Log Retention – Compliance with legal and business requirements.
Audit Trails – Logs should be protected from tampering.
Time Synchronization – Using NTP (Network Time Protocol) to ensure timestamps are accurate.

3.2 Intrusion Detection and Prevention

IDS (Intrusion Detection System) – Monitors and alerts on potential attacks.
IPS (Intrusion Prevention System) – Blocks suspicious traffic.
HIDS vs. NIDS – Host-based (HIDS) vs. Network-based (NIDS) detection.

4. Incident Response and Management

Incident response is crucial for minimizing damage and recovering from security breaches.

4.1 Incident Response Process (NIST SP 800-61)

Preparation – Develop policies, train staff, and create an incident response plan.
Detection & Analysis – Identify indicators of compromise (IOCs), analyze logs, and classify incidents.
Containment, Eradication, and Recovery Containment – Limit the scope of the incident (e.g., isolate systems). Eradication – Remove the threat (e.g., patching, removing malware). Recovery – Restore normal operations and monitor for reoccurrence.
Post-Incident Activity – Conduct lessons learned and update security measures.

4.2 Attack Classification

DoS/DDoS Attacks – Overloading systems.
Malware Infections – Ransomware, rootkits, worms, etc.
Insider Threats – Employees misusing privileges.
Advanced Persistent Threats (APT) – Nation-state or highly organized cybercriminal groups.

5. Disaster Recovery (DR) and Business Continuity (BC)

Ensuring the organization can continue operations after a disruption.

5.1 Business Continuity Planning (BCP)

Business Impact Analysis (BIA) – Identifies critical assets and recovery objectives.
Recovery Time Objective (RTO) – Maximum downtime allowed before recovery.
Recovery Point Objective (RPO) – Maximum data loss tolerable.

5.2 Disaster Recovery Strategies