Play It Safe: Manage Security Risks
Frameworks you must be able to order
The NIST Cybersecurity Framework (CSF) has five functions: Identify, Protect, Detect, Respond, Recover. The NIST Risk Management Framework (RMF) has seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor. Memorize the counts and the first letters; ordering questions are common.
Security controls, two dimensions
Controls are described by category and by type, and questions mix the two. Categories: technical (firewalls, encryption, antivirus), managerial (policies, risk assessments), operational (security guards, awareness training, day-to-day procedures), physical (locks, cameras, badge readers). Types: preventive (stops it), detective (notices it), corrective (fixes it after), deterrent (discourages it), compensating (substitutes for a preferred control).
Operations
A SIEM collects logs from many sources, normalizes the formats, correlates events, and surfaces alerts on dashboards (Splunk, Chronicle). A playbook is the documented step-by-step procedure for a detection or response. OWASP Top 10 is a widely used list of web application risks. A security audit is an independent review against a benchmark or standard.
The incident response lifecycle (NIST) is: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-incident Activity.
Traps
Watch for CSF functions blended with IR phases, and for Monitor offered as a CSF function (it belongs to the RMF). A detective control never prevents anything, and a compensating control is not the same as a corrective one.
Rule of thumb
Ask three questions of any control: does it stop it (preventive), notice it (detective), or fix it (corrective)? Then ask what kind of thing it is technically, managerially, operationally, or physically.