Domain 5: Security Operations

Security operations is the day-to-day work of protecting data and systems: handling data, hardening systems, monitoring, policies and training.

Data handling

Classification: labelling data by sensitivity, e.g. public, internal, confidential, restricted.
Labelling: marking data and media with their classification so people handle them correctly.
Retention: keeping data only as long as policy, law or business need requires.
Data life cycle: create, store, use, share, archive, destroy.

Data destruction methods

Clearing: overwriting data so it cannot be recovered with normal tools.
Purging: removing data so it cannot be recovered even in a laboratory, e.g. degaussing magnetic media.
Physical destruction: shredding, crushing, pulverising or incinerating the media; the most certain method.

Logging and monitoring

Log: a record of events on a system or network.
SIEM: security information and event management; collects and correlates logs from many sources and raises alerts.
Baseline: a record of normal activity, used to spot anomalies.

Logs should be protected from tampering, time-synchronised (for example with NTP), and reviewed regularly.

Encryption

Symmetric encryption: one shared key encrypts and decrypts; fast, used for bulk data (e.g. AES).
Asymmetric encryption: a public and a private key; used for key exchange and digital signatures (e.g. RSA, ECC).
Hashing: a one-way function giving a fixed-size digest; used to check integrity (e.g. SHA-256).
Encryption at rest: protects stored data.
Encryption in transit: protects data moving over a network (e.g. TLS).

System hardening

Configuration baseline: an approved secure configuration that systems are built and checked against.
Hardening: removing unneeded services, accounts and software, and applying secure settings.
Patch management: testing and applying updates promptly to fix vulnerabilities.
Change management: request, review, approval, testing and documentation before a change, with a rollback plan.

Security policies

Acceptable use policy (AUP): what users may and may not do with organisational systems.
Data handling policy: how data of each classification is stored, shared and destroyed.
Password policy: length, complexity, reuse and rotation rules.
Bring your own device (BYOD) policy: rules for personal devices used for work.
Privacy policy: how personal data is collected, used and protected.

Security awareness training

Training makes people a line of defence. Topics include recognising phishing and social engineering, passwords and MFA, safe data handling, reporting incidents, and physical security such as tailgating. It should be regular and measured, for example with simulated phishing exercises.

Phishing: fraudulent messages that trick people into revealing information or installing malware.
Spear phishing: phishing aimed at a specific person or group.
Whaling: phishing aimed at senior executives.
Vishing: phishing by voice call.
Smishing: phishing by text message.
Pretexting: inventing a scenario to win someone's trust.
Tailgating: following an authorised person through a secure door without badging in.