Project Part 10
1. Access Controls
This domain deals with access to the system, and the data contained within. It incorporates access to the building, specific locations within the building, access to a computer, and access to drives and files on those drives. Equally as important it incorporates the business reason for applying certain permissions to those users who require access.
2. Security Operations and Administration
This domain covers the security of an organization as a whole, dealing with the best practices and end results, of to how security is accomplished. It incorporates the documentation required to present the steps that will ensure the C-I-A of an organizations network.
3. Monitoring and Analysis
This domain deals with activities that are accountable for collecting information. This covers sifting through the log files, and auditing the system looking for events, or possible attack paths. It also covers auditing internal use to ensure that the users are following best practices and adhering to the AUP.
4. Risk, Response, and Recovery
This area covers the entire real of risk management. This includes identifying risk and ways to mitigate it, protocol to responding to various incidents, and business continuity planning.
5. Cryptography
This domain covers the protection of information, primarily done by altering the data to ensure its integrity. . It also deals with the key management of digital signatures.
6. Networks and Communications
This domain applied to the network infrastructure and the measures of security taken to ensure the integrity of its data. It protects the data transmitted in both the private and public communication networks.
7. Malicious Code and Activity
This domain covers the art of hacking itself. Someone who works with this area will perform penetration testing and keep up to date with the current malware threats.