Domain 1
Security & Risk Management
Governance, risk, compliance, and the foundations of an infosec program.
The CIA Triad
- Confidentiality — prevent unauthorized disclosure of information.
- Integrity — prevent unauthorized or accidental modification.
- Availability — ensure authorized users get timely access.
Every control ultimately serves one or more of these three properties.
Risk Treatment Options
- Avoid — stop the activity that creates the risk.
- Mitigate — apply controls to reduce likelihood or impact.
- Transfer — shift the risk (e.g. insurance, outsourcing).
- Accept — knowingly retain the residual risk.
Domain 2
Asset Security
Classifying, handling, and protecting data and assets through their lifecycle.
Data Classification
- Assign sensitivity labels (e.g. Public, Internal, Confidential, Restricted).
- Classification drives the required handling controls.
- The data owner sets classification; the custodian enforces it.
Domain 3
Security Architecture & Engineering
Secure design principles, models, cryptography, and system engineering.
Defense in Depth
- Layer independent controls so no single failure is fatal.
- Combine preventive, detective, and corrective controls.
- Assume any one layer will eventually be bypassed.
Domain 4
Communication & Network Security
Securing network architecture, protocols, and data in transit.
Firewall Policy: Default Deny
- Deny all traffic, then explicitly permit only what is required.
- A permissive any-any rule defeats the entire ruleset.
- Order matters — the first matching rule wins.
Domain 5
Identity & Access Management
Identification, authentication, authorization, and accountability.
AAA
- Authentication — prove who you are.
- Authorization — determine what you may do.
- Accounting — record what you did.
Access Control Models · Domain 5
Discretionary Access Control (DAC)
The owner of a resource decides who else can access it — and at what level. The most common model in everyday operating systems.
How it works
- Every object (file / folder) has an owner with full discretion.
- An Access Control List (ACL) on the object maps subjects to rights: read, write, execute.
In practice
- Windows NTFS permissions; Linux / Unix file permissions.
- Create a file → you become the owner → you decide access — no admin required.
Advantage — Flexibility
- Decisions sit with the owner, not a central authority.
- Easy in smaller environments; fast sharing, low overhead.
Weaknesses
- Privilege creep — casual grants pile up, rarely reviewed.
- Trojan horse — a program inherits the user's rights; DAC checks identity, not intent.
- No central enforcement — no consistent system-wide policy.
Domain 6
Security Assessment & Testing
Assessing control effectiveness through testing, audits, and metrics.
Vulnerability Scan vs. Penetration Test
- Vulnerability scan — broad, automated, finds known weaknesses.
- Penetration test — targeted, manual, proves exploitability.
- Scans tell you what might be open; pentests show what an attacker can do.
Domain 7
Security Operations
Running detection, response, monitoring, and recovery day to day.
Incident Response Lifecycle
- Preparation
- Detection & Analysis
- Containment, Eradication & Recovery
- Post-Incident Activity (lessons learned)
Domain 8
Software Development Security
Building security into the software development lifecycle.
Shift Left
- Move security activities earlier in the SDLC.
- Threat modeling and secure design cost far less than post-release fixes.
- Automate checks (SAST/DAST/deps) in the CI pipeline.