CISSP quick pointers (This will keep updating regularly)
- Physical security/Human Life is first priority and everything else comes next E.g. Company is highly secure in terms of cybersecurity but what if there is no fire alarm, fire extinguishers, etc..?? People will loose life and nothing matters after this.
- Protect the business mission & not just the systems
- Security policies over individual technology configs like E.g. Instead of saying like set-up routing OSPF or BGP, firewall with AES encryption etc.. set-up a policy to say routers will follow a certain setup and encryptions, don't choose or think like sysadmin in your exams
- Long term over short term: Short term = Setup routing, Long-term = Baseline all routers should be set to certain security thing.
- Security must enable the business objectives and goals, it should not block them.
- The role of security is to reduce the risk to acceptable levels while still supporting the business operations.
- Security is a top-down approach (Senior management is accountable)