2 cissp ® Official Study Guide Eighth Edition

Understand the importance of declassification.
Declassification is required once an asset 
no longer warrants the protection of its currently assigned classification or sensitivity level.
Know the basics of COBIT.
Control Objectives for Information and Related Technologies 
(COBIT) is a security concept infrastructure used to organize the complex security solu-
tions of companies.
Know the basics of threat modeling.
Threat modeling is the security process where poten-
tial threats are identified, categorized, and analyzed. Threat modeling can be performed as 
a proactive measure during design and development or as a reactive measure once a product 
has been deployed. Key concepts include assets/attackers/software, STRIDE, PASTA, Trike, 
VAST, diagramming, reduction/decomposing, and DREAD.
Understand the need to apply risk-based management concepts to the supply chain.
Applying risk-based management concepts to the supply chain is a means to ensure a more 
robust and successful security strategy in organizations of all sizes. When purchases and 
acquisitions are made without security considerations, the risks inherent in those products 
remain throughout their deployment life span.
Written Lab
1.
Discuss and describe the CIA Triad.
2.
What are the requirements to hold a person accountable for the actions of their user 
account?
3.
Describe the benefits of change control management.
4.
What are the seven major steps or phases in the implementation of a classification 
scheme?
5.
Name the six primary security roles as defined by (ISC)
2
for CISSP.
6.
What are the four components of a complete organizational security policy and their 
basic purpose?

---

Review Questions