Mastering Cybersecurity Foundations: CISSP Domains, Threats, Frameworks, and Practical Tools

Introduction

Ashley, a Customer Engineering Enablement Lead at Google, welcomes learners to a comprehensive security course. The program builds on earlier lessons about basic security concepts, the CIA triad, and historic cyber‑attacks, then dives deeper into CISSP domains, threats, risk management, frameworks, controls, audits, tools, and incident‑response playbooks.

CISSP’s Eight Security Domains

First Four Domains - Security and Risk Management – defines goals, risk mitigation, compliance, business continuity, and legal/ethical responsibilities. - Asset Security – protects digital and physical assets, covers data storage, retention, and secure disposal (e.g., hard‑drive shredding). - Security Architecture & Engineering – emphasizes secure design, shared responsibility, and policies that encourage reporting. - Communication & Network Security – secures wired, wireless, and cloud communications; restricts insecure Bluetooth/Wi‑Fi use.

Last Four Domains - Identity & Access Management (IAM) – identification, authentication, authorization, and accountability; principle of least privilege. - Security Assessment & Testing – control testing, data analysis, audits; example: implementing MFA. - Security Operations – incident investigation, forensic evidence collection, mitigation. - Software Development Security – secure coding, SDLC security reviews, penetration testing.

Threats, Risks, and Vulnerabilities

• Threats – events that can harm assets (e.g., phishing, social engineering).
• Risks – likelihood that a threat will affect confidentiality, integrity, or availability; classified as low, medium, high.
• Vulnerabilities – weaknesses such as outdated firewalls, weak passwords, or human error.
• Impact Examples – financial loss, identity theft, reputation damage.

Ransomware and the Three Web Layers

• Ransomware encrypts data, freezes systems, and demands payment; may involve dark‑web negotiations.
• Web Layers – Surface web (public), Deep web (authorized access, e.g., intranets), Dark web (anonymous, often used by criminals).

NIST Risk Management Framework (RMF)

Seven steps guide risk handling: 1. Prepare – monitor risks, identify controls. 2. Categorize – assess impact on confidentiality, integrity, availability. 3. Select – choose and document controls (playbooks, policies). 4. Implement – deploy security/privacy plans. 5. Assess – verify controls work as intended. 6. Authorize – generate reports, align with security goals. 7. Monitor – continuously track system performance and adjust.

Security Frameworks & Controls

• Frameworks provide baseline policies (e.g., NIST CSF, NIST SP 800‑53) for risk mitigation and compliance.
• Controls reduce specific risks; three common types:
• Encryption – converts plaintext to ciphertext for confidentiality.
• Authentication – verifies identity (passwords, MFA, biometrics).
• Authorization – grants permission to resources.
• CIA Triad – Confidentiality, Integrity, Availability; guides all security decisions.

OWASP Design Principles

• Minimize attack surface.
• Apply least privilege.
• Use defense‑in‑depth (multiple layers of controls).
• Separate duties.
• Keep security simple.
• Fix issues correctly (root‑cause analysis, remediation).

Security Audits

Internal audits assess scope, goals, risk, controls, compliance, and communication of results. Elements include: - Defining audit scope and objectives. - Conducting risk assessments. - Performing controls assessments (administrative, technical, physical). - Verifying compliance (e.g., GDPR, PCI‑DSS). - Reporting findings to stakeholders.

Security Tools: Logs, SIEM, Dashboards, and Platforms

• Log Types – firewall, network, server logs record connection attempts, device activity, and service events.
• SIEM (Security Information & Event Management) aggregates logs, provides real‑time alerts, and stores data centrally.
• Dashboards visualize alerts, metrics (e.g., login attempts, geographic anomalies) for rapid decision‑making.
• Common SIEM Solutions – Splunk Enterprise (self‑hosted), Splunk Cloud (cloud‑hosted), Google Chronicle (cloud‑native). Hybrid deployments combine both.

Playbooks & Incident Response

A playbook is a step‑by‑step manual for handling incidents. The six phases of an incident‑response playbook are: 1. Preparation – policies, staffing, training. 2. Detection & Analysis – identify and assess events. 3. Containment – limit damage. 4. Eradication & Recovery – remove artifacts, restore systems. 5. Post‑Incident Activity – documentation, lessons learned. 6. Coordination – reporting, compliance, stakeholder communication. Playbooks ensure consistency, speed, and compliance during attacks such as ransomware or malware.

Course Recap

• Reviewed CISSP’s eight domains and their practical relevance.
• Explored threats, risks, vulnerabilities, ransomware, and web layers.
• Learned the NIST RMF’s seven steps.
• Studied frameworks, controls, the CIA triad, and OWASP principles.
• Understood internal audit components.
• Gained familiarity with logs, SIEM tools, dashboards, and major platforms.
• Mastered incident‑response playbooks and their six phases.

The knowledge gained equips entry‑level analysts to protect assets, respond to incidents, and contribute to a strong security posture.

A solid grasp of CISSP domains, risk frameworks, security controls, and practical tools like SIEM and playbooks empowers new analysts to safeguard organizational assets and respond swiftly to cyber threats.