ASIS APP cheat sheet

CIA triad: Confidentiality (authorized disclosure only), Integrity (accuracy and completeness), Availability (timely, reliable access).

Defense in depth layers controls so no single failure compromises the asset; each layer assumes the prior layer failed.

Three control types by function: preventive (blocks), detective (identifies), corrective (restores).

Control categories by nature: administrative/managerial, technical/logical, physical.

Least privilege: every subject gets the minimum access rights needed for its function, for the minimum duration.

Separation of duties splits a sensitive task so no single person can complete it alone; collusion is the residual risk.

Authentication factors: something you know, have, are; MFA requires two or more different factor types.

Access control models: DAC (owner discretion), MAC (labels/clearance), RBAC (role-based), ABAC (attribute-based).

Security must be framed in business terms: cost of control vs. expected loss avoided (ALE) drives approval.

Governance hierarchy: board/executives set risk appetite; security leadership translates it into policy; managers enforce.

Policy types: policy (mandatory intent), standard (specific mandatory requirements), procedure (step-by-step), guideline (recommended).

Security strategy aligns to organizational mission, legal/regulatory obligations, and contractual requirements.

Security awareness training targets behavior change; role-based training targets job-specific competency.

Metrics should be tied to business outcomes (e.g., incident cost, downtime hours), not raw tool counts.

Third-party risk: due diligence before contract, security requirements in the agreement, periodic reassessment.

Budget justification uses risk quantification (ALE, ROI of control) and regulatory exposure.

Risk = threat x vulnerability x impact; a risk exists only where a threat can exploit a vulnerability with consequence.

Quantitative: SLE = asset value x exposure factor; ALE = SLE x annualized rate of occurrence (ARO).

Qualitative: likelihood x impact scales (e.g., high/medium/low) producing a ranked risk register.

Risk responses: avoid, mitigate/reduce, transfer (e.g., insurance), accept (with documented authority).

Residual risk = risk remaining after controls; it must fall within the organization's risk appetite/tolerance.

Risk assessment steps: identify assets, identify threats and vulnerabilities, assess likelihood and impact, evaluate against criteria.

Business impact analysis identifies critical functions, RTO (max tolerable downtime) and RPO (max tolerable data loss).

Control selection is cost-benefit: implement when expected loss reduction exceeds control cost.

Layered perimeter: site perimeter, building envelope, interior zones, asset enclosure; each layer delays or detects intrusion.

Crime Prevention Through Environmental Design (CPTED) principles: natural surveillance, natural access control, territorial reinforcement, maintenance.

Doors and locks are rated by function and resistance; fail-safe locks release on power loss (life safety), fail-secure locks stay locked.

Access control at portals uses credentials plus a second factor; anti-passback prevents credential sharing through a door.

Intrusion detection sensors: passive infrared (body heat/motion), dual-technology (PIR + microwave reduces false alarms), glass-break, vibration.

CCTV: camera coverage, lighting, and recording retention define evidentiary value; monitor for detection, record for investigation.

Fire and life safety takes precedence: egress paths, exit signage, and suppression must not be defeated by security controls.

Visitor management: escort requirements, badge issuance/return, and logs provide accountability for non-employees.