Security Solutions, Operations and Management
Domain 6 addresses security solutions, operations, and management: moving from design to sustained operation. The exam tests deployment, configuration baselines, change and patch management, monitoring, incident response, service levels, continuity, and secure disposal.
Core rules
- Accept the solution against documented criteria before production; verify configuration matches the approved baseline.
- Establish configuration control, patch management, backup, restoration, and rollback procedures.
- Define monitoring: log sources, correlation, alert thresholds, review cadence, and escalation.
- Integrate incident response, vulnerability management, and problem management with change control.
- Measure service performance and security effectiveness; tune controls using operational data.
- Plan decommissioning: data sanitization, key destruction, account removal, and records retention.
Worked example
A team deploys an intrusion detection capability. Acceptance tests confirm sensor placement, log ingestion, alert routing, and fail-open behavior. The runbook defines tuning: initial false-positive baseline, weekly review, and change tickets for signature updates. Monitoring shows a noisy rule; the team tunes it and records the change, preserving an audit trail. A rollback plan restores the previous sensor configuration within one hour. At end of life, disks are sanitized and keys destroyed.
Traps
Deploying without an O&M plan; no rollback; untested backups; alerting without triage; patch exceptions without compensating controls; and forgetting disposal and key destruction.