Information System Security Management
Domain 5 tests access control models, the mechanics of antivirus and patch management, and the order of steps in incident handling. Judgement items ask what you do first, and what evidence you must not destroy.
Access control
Chain: identification, authentication, authorization, accountability. Models: DAC (owner grants), MAC (system labels and clearances), RBAC (permissions attached to roles), ABAC (attributes). Apply least privilege and separation of duties; require MFA for remote and privileged access; review accounts periodically; prohibit shared accounts so that audit trails remain attributable. Privileged actions should go through controlled elevation and be logged.
Antivirus and patch management
Endpoint protection combines signatures with behaviour detection, so update frequency and scan windows matter. Patch cycle: inventory assets and versions, assess severity, test in a pilot ring, schedule a production window, deploy, verify, and keep a rollback plan. Emergency patches skip the pilot but still get a record. Firmware and appliance images need the same discipline as operating systems.
Incident handling
Phases: preparation; detection and reporting; containment; eradication; recovery; lessons learned. Preserve volatile evidence first (memory, running processes, network connections), keep a chain of custody, isolate the host from the network by disabling the link rather than powering off, notify according to the policy and legal thresholds, then rebuild from known-good media and restore from a verified clean backup.
Worked example
At 09:00 a file server shows mass file renaming consistent with ransomware. Order of action: isolate the network link but keep the machine powered so memory and keys can be captured; notify the security lead and management; scope the spread using logs and file share access records; eradicate by rebuilding the host; restore data from an offline backup verified as uninfected; patch the entry vector; then write the lessons-learned report. Reasoning: containment before eradication limits damage, and powering off destroys the evidence needed to explain scope.
Traps
- Recommending payment of a ransom, or deleting infected files before evidence capture.
- Testing patches directly in production to save time.
- Granting permanent administrator rights to close a ticket.
- Treating installed antivirus as equivalent to a patched, hardened system.
- Containment attempted after eradication has already started.