The Effective CISSP
Security and Risk Management

I’m working on my first book of the Effective CISSP series:
The Effective CISSP – Security and Risk Management
I hope it will be available on Amazon in November.

As an experienced IT/InfoSec professional, I’ve tried my best to integrate all the domain knowledge to guide CISSP aspirants with technical background through the governance and management areas.

This book is helpful both to CISSP and CISM.

Added on 2020/05/11:

A BLUEPRINT FOR YOUR SUCCESS IN CISSP

My new book, The Effective CISSP: Security and Risk Management, helps CISSP aspirants build a solid conceptual security model. It is not only a tutorial for information security but also a study guide for the CISSP exam and informative reference for security professionals.

• It is available on Amazon.
• Readers from countries or regions not supported by Amazon can get your copy from the author’s web site.

Risk Exposure

Risk exposure is a measure of risk that is evaluated with consideration of all the risk factors. If the effect is evaluated with monetary value, risk exposure is an indicator of potential financial loss. A risk score is a common type of risk exposure.

Risk = Threat x Vulnerability

This formula is overly simplified and has been misunderstood for years. It is elaborated as follows:

• The Risk term in the formula should refer to “Risk Score” or “Risk Exposure.”
• The Threat term in the formula should refer to “The impact of a threat.”
• The Vulnerability term in the formula should refer to “The likelihood of the vulnerability being exploited.”
• The formula should be interpreted as “Risk Exposure is a function of the impact of a threat and the likelihood of the vulnerability being exploited.” As a result, the calculation doesn’t necessarily have to be multiplication.

Standard

A policy may mandate that all devices must be adequately protected. A standard supporting this policy requires that all operating systems on PCs must be Windows 8 or higher.

Baseline

A snapshot of PCs with Windows 8 is taken as the configuration baseline. Let’s call it baseline version 1.0.

Change Management

One year goes by, a change request to upgrade the PCs to Windows 8.1 is submitted. It is approved and implemented; the baseline version 1.0 is changed to baseline version 1.1, Windows 8.1.

Now, the latest baseline is version 1.1 (Windows 8.1), while the standard remains intact, Windows 8 or higher.

Summary

In this case, a standard is a document, while a baseline is a snapshot that meets the standard. A baseline can be changed only through the change management process.

NIST Generic Risk Model (NIST SP 800-30 R1)

NIST SP 800-30 R1

According to the generic risk model introduced in NIST SP 800-30 R1, a risk is decomposed into a couple of factors as the diagram denotes.

Threat Event and TTP

A threat event involves tactics, techniques, and procedures (TTP for short). It’s a good practice to describe a threat event by starting with a verb so that it can be matched with threat sources to shape threat scenarios.

Good Practice

This good practice can be found in Table E-2 of Appendix E.

Questions to Ponder

What is a threat?

Do you have a definition in your mind that is shared, communicated, and agreed upon?

Risk Model vs Threat Model

Since we are talking about the threat, why it relates to risk and the model is called a generic risk model that includes threat things, instead of being called a generic threat model?

Related Posts

• WENTZ’S INFORMATION RISK MODEL V1.1

Amazon DynamoDB is a key-value and document database (NoSQL) that supports ACID transactions.

It’s a big achievement!!

DynamoDB

Amazon DynamoDB is a key-value and document database that delivers single-digit millisecond performance at any scale. It’s a fully managed, multiregion, multimaster, durable database with built-in security, backup and restore, and in-memory caching for internet-scale applications. DynamoDB can handle more than 10 trillion requests per day and can support peaks of more than 20 million requests per second.

https://aws.amazon.com/dynamodb/

ACID Transactions

DynamoDB transactions provide developers atomicity, consistency, isolation, and durability (ACID) across one or more tables within a single AWS account and region. You can use transactions when building applications that require coordinated inserts, deletes, or updates to multiple items as part of a single logical business operation.

https://aws.amazon.com/tw/blogs/aws/new-amazon-dynamodb-transactions