CBK 2018: Incident Management Trick for CISSP 🔑

Note: this is from the 2018 Common Body of Knowledge. This lesson will help CISSP candidates (and hopefully others) to quickly understand and memorize the incident management steps as presented in Domain 7, Security Operations.

https://www.facebook.com/CISSPMicroModules/

All of my videos are current and presented as part of the common body of knowledge (CBK) update that was done in April of 2018.

The D is for detection. This is where an IDS or IPS, or even a user reports that there is an issue.

Next, the R, is for response. This is where triage occurs and where analysts and management try to figure out whether there’s really an incident, the formal declaration happens at this step.

M is for mitigation. This is the first containment action that occurs.

The next R is for reporting to all relevant stakeholders, such as customers, vendors, regulators, and law enforcement

The next R is for recovery. This is where activities are performed to return the operations to a normal state.

The last R is for remediation, this is where the root cause is addressed.

L is the last letter, which is for lessons learned. This is where discussions take place with the response team to improve how similar incidents will be handled in the future, and where the overall process is improved.