Description

Prepare for domain 1 of the CompTIA Advanced Security Practitioner (CASP+) exam. Review topics to better understand risk management and its impact on leaders' decision-making.

Tags

Syllabus

Syllabus IntroductionWelcomeWhat you should knowAbout the examRisk management fundamentals1. Risk Mitigation Strategies and Controls (Obj. 1.3)The CIA triadData security classificationStakeholders input into CIA decision makingAccess control categoriesAccess control typesThe aggregate CIA scoreExtreme scenario and worst-case scenario planningExtreme scenario and worst-case scenario exampleSystem-specific risk analysisRisk determinationMagnitude of impactLikelihood of threatReturn on investmentTotal cost of ownershipRisk management strategiesRisk management processContinuous improvement and monitoringBusiness continuity planning (BCP)IT governance2. Business and Industry Influences and Associated Security Risks (Obj. 1.1)Risk management of new products, technologies, and user behaviorsBusiness models and strategiesPartnershipsOutsourcingThird-party outsourcing and securityCloudAcquisition or mergers and divestiture or demergerIntegrating diverse industriesInternal and external influencesDe-perimeterization3. Security, Privacy Policies, and Procedures in Risk Management (Obj. 1.2)Changes and policy developmentChanges and process or procedure developmentLegal and regulatory complianceRisk assessment or Statement of ApplicabilityBusiness Impact AnalysisInteroperability Agreement and Interconnection Security AgreementMemorandum of UnderstandingService Level Agreement and Operating Level agreementNon-Disclosure AgreementBusiness Partnership AgreementMaster service agreementPrivacy considerationsSeparation of dutiesJob rotation and mandatory vacationsLeast privilegeIncident responseDigital forensicsEmployment and termination proceduresContinuous monitoringUser training and awarenessAuditing requirements and frequency4. Measurements and Metrics in Risk Management (Obj. 1.4)Benchmarks and baselinesPrototyping and multiple test solutionsCost benefit analysisMetrics collection and analysisAnalyzing and interpreting trend dataReviewing security controlsReverse engineering and deconstructing security solutionsAnalyzing security solutions to meet your business' needsvideos learned and after-action reportsSolving difficult problems that have no right answerConclusionNext steps Read more