Objectives

• Discuss the Information Security Triad


• Explain the relationships between other information security models and the Information Security Triad


• Discuss the eight principles of secure design


• Explain the security life cycle


• Determine what information resources are considered assets


• Identify possible threats and vulnerabilities to information assets


• Evaluate formulas to determine asset values, and losses to an organization


• Investigate risk mitigation strategies for organizations


• Establish appropriate countermeasures and safeguards to deploy, and which risks should be mitigated by them


• Identify and distinguish between types of security policies


• Discuss security policy enforcement, based on policy type


• Explain the concepts and actions associated with administering security policies


• Discuss how to develop a business continuity plan


• Explain methods for testing a business continuity plan


• Discuss the life cycle of a business continuity plan


• Explain common and uncommon scenarios where a business continuity plan is invoked


• Define Operational Security, and review its history


• Identify the Laws of OPSEC


• Identify adversaries' motivations, and intelligence gathering techniques


• Determine Physical and Administrative security controls relating to OPSEC


• Discuss the characteristics of confidentiality and integrity access control models


• Identify types of access controls and categorize them appropriately


• Explain the methods for managing access controls


• Review identification and authentication in the context of access control