Chapter 8 - Domain 7: Security Operations (e.g., Foundational Concepts, Investigations, Incident Management, Disaster Recovery)

Abstract

Security Operations focuses on configuration and change management. Continuity of Operations is also presented in this chapter with discussions of different methods of trying to ensure availability through highly available systems, Redundant Array of Inexpensive Disks (RAID), and Service Level Agreements (SLA). A methodology and discussion about incident response is the final focus of the Operations Security domain. The second part of Chapter 8 focuses on Business Continuity and Disaster Recovery Planning. A thorough understanding of both Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP) is required in order to be successful with questions from this domain. A key goal is to understand the differences in the scope and purpose of the BCP and DRP. DRP represents a more tactical information systems focused exercise while the BCP, which includes DRP as one of its components, is considerably more vast and high level. Key concepts for this domain include that of performing a Business Impact Analysis (BIA) and determining a system’s Maximum Tolerable Downtime (MTD).