2 cissp ® Official Study Guide Eighth Edition

Understand the need to control access to audit reports.
Audit reports typically address 
common concepts such as the purpose of the audit, the scope of the audit, and the results 
discovered or revealed by the audit. They often include other details specific to the envi-
ronment and can include sensitive information such as problems, standards, causes, and 
recommendations. Audit reports that include sensitive information should be assigned a 
classification label and handled appropriately. Only people with sufficient privilege should 
have access to them. An audit report can be prepared in various versions for different tar-
get audiences to include only the details needed by a specific audience. For example, senior 
security administrators might have a report with all the relevant details, whereas a report 
for executives would provide only high-level information.
Understand access review and user entitlement audits.
An access review audit ensures that 
object access and account management practices support the security policy. User entitle-
ment audits ensure that the principle of least privilege is followed and often focus on privi-
leged accounts.
Audit access controls.
Regular reviews and audits of access control processes help assess 
the effectiveness of access controls. For example, auditing can track logon success and fail-
ure of any account. An intrusion detection system can monitor these logs and easily identify 
attacks and notify administrators.
Written Lab
1.
List the different phases of incident response identified in the CISSP Security Opera-
tions domain.
2.
Describe the primary types of intrusion detection systems.
3.
Describe the relationship between auditing and audit trails.
4.
What should an organization do to verify that accounts are managed properly?

---