Security Operations
Domain 7 tests the day-to-day discipline that keeps controls working: inventories, baselines, change control, vulnerability and patch management, and recovery planning. L1 items are procedural - they describe an operational situation and ask for the correct process step or priority.
The operational backbone
- Asset inventory first: you cannot protect or patch what you have not recorded. A CMDB with owner, criticality and location is the base for everything else.
- Configuration baseline per host and network class, with drift detection.
- Change management: request, risk assessment, approval (CAB for significant changes), scheduled window, tested rollback, and post-change verification. Emergency changes still get documented afterwards.
- Vulnerability management as a cycle: discover, prioritize, remediate, verify, report. Priority combines severity (CVSS), internet exposure, exploit availability, data sensitivity and compensating controls - score alone is not priority.
- Patch management with staged rollout: test group, then production, with a rollback path.
Backups and disaster recovery
Know the difference between RTO, the maximum tolerable downtime, and RPO, the maximum tolerable data loss measured backwards from the incident. Full backups copy everything; incremental copies changes since the last backup of any type (fast, but restore needs the chain); differential copies changes since the last full (slower, simpler restore). Recovery is only proven by a restore test.
Worked example
Two findings: CVSS 9.8 remote code execution on an internet-facing VPN concentrator with a public exploit, and CVSS 7.5 on an internal laboratory system isolated behind two firewalls. Which first? Reasoning: the VPN finding is exploitable now by anyone on the internet, so it is both more likely and more exposed; the lab system requires prior internal access. Fix the VPN within the emergency change process, with a compensating restriction (limit source addresses, add monitoring) until the patch window. The lab finding stays on the normal cycle and is documented with an owner and due date. Ranking purely by CVSS number would distract attention from the larger real risk.
Traps that cost marks
- Prioritizing by CVSS score alone, ignoring exposure and exploit maturity.
- Patching production without a tested rollback.
- Confusing RTO with RPO, or confusing incremental with differential backups.
- Assuming an approved change is verified: verification and closure are part of the process.