Cracking CISSP Domain 1: Security & Risk Management – A Practical Study Guide

Domain 1 is the beast of the CISSP exam. It accounts for approximately 15% of the questions and sets the foundational tone for the entire certification. If you don’t understand the concepts here (Risk, Governance, Ethics), you will likely struggle with the other seven domains.

Why Domain 1 Is Critical

This domain tests whether you understand why security exists. It’s not about configuring firewalls; it’s about aligning security with business goals, managing risk to an acceptable level, and adhering to laws and ethics. It’s the “Management” in “Information Security Management”.

1. Security Governance & Principles

You must live and breathe the CIA Triad:

• Confidentiality: Encryption, Access Controls, Steganography.
• Integrity: Hashing, Digital Signatures, Write-Once-Read-Many (WORM).
• Availability: Redundancy, Backups, Patching, DDoS protection.

Understand the hierarchy: Laws > Regulations > Policies > Standards > Procedures > Guidelines.

CISSPWant to practise this hands-on? Crack CISSP in 1st Attempt covers it with live labs and mentor support.

2. Personnel Security

Humans are often the weakest link. Key concepts include:

• Background Checks: Proportional to the sensitivity of the role.
• Onboarding/Termination: Revoking access immediately upon termination is a favorite exam topic.
• Separation of Duties (SoD): No single person can complete a critical task alone (prevents fraud).
• Job Rotation / Mandatory Vacations: Detects fraud by forcing someone else to do the job.

3. Risk Management Concepts

This is the core of the exam. Memorize the formulas, but more importantly, understand the logic:

• Asset Value (AV): What is it worth?
• Exposure Factor (EF): % loss if a threat happens.
• Single Loss Expectancy (SLE): AV * EF.
• Annualized Rate of Occurrence (ARO): How many times per year?
• Annualized Loss Expectancy (ALE): SLE * ARO.

Risk Responses: Avoid, Mitigate (Reduce), Transfer (Insurance), Accept.

4. Threat Modeling

Proactive identification of threats. Know these methodologies:

• STRIDE: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege. (Focuses on developers).
• PASTA: Process for Attack Simulation and Threat Analysis. (Risk-centric).
• DREAD: Damage, Reproducibility, Exploitability, Affected Users, Discoverability. (Used for ranking).

5. Supply Chain Risk Management

You are responsible for your vendors’ security. Service Level Agreements (SLAs) and Right to Audit clauses are your primary controls here. The exam focuses heavily on third-party risk.

6. Security Awareness & Training

Training changes behavior. Awareness keeps security top-of-mind. Know the difference between:

• Education: “Why” (for decision makers).
• Training: “How” (for skills).
• Awareness: “What” (for everyone).

7. Business Continuity Planning (BCP)

Keeping the business running during a disaster. The BCP process:

1. Project Initiation: Management support is mandatory.
2. Business Impact Analysis (BIA): Identify critical processes and MTD (Max Tolerable Downtime).
3. Recovery Strategy: Cold site, Warm site, Hot site.
4. Plan Design & Development.
5. Testing & Maintenance: Checklist, Walkthrough, Simulation, Parallel, Full Interruption.

8. Legal & Regulatory Issues

Understand the major categories of law:

• Criminal Law: Jail time (harm to society).
• Civil Law: Money/Damages (contracts, torts).
• Administrative Law: Regulatory compliance (HIPAA, GDPR).

Know the difference between Copyright (expression of ideas), Patent (invention), Trademark (brand), and Trade Secret.

9. Ethics

The ISC2 Code of Ethics is testable material. The 4 Canons in order of priority:

1. Protect society, the common good, necessary public trust and confidence, and the infrastructure.
2. Act honorably, honestly, justly, responsibly, and legally.
3. Provide diligent and competent service to principals.
4. Advance and protect the profession.

If you have to choose between protecting your boss (Canon 3) and protecting society (Canon 1), Canon 1 wins.

How to Approach Domain 1 Questions

• Think Like a Manager: Don’t fix the server yourself; hire someone or write a policy to ensure it gets fixed.
• Human Safety First: If a fire breaks out, saving data is secondary to saving lives. Always.
• Money Matters: Don’t spend $100,000 to protect a $10 asset. Cost-benefit analysis drives decisions.