Security Practices, Risk Management, and Compliance

Explain Introduction.

Explain Information Security Risk Management.

Explain Asset Identification and Valuation.

Explain Threat Identification and Threat Intelligence.

Security technology alone cannot protect an organization.

Encryption protects data at rest but not the application that decrypts it.

The gap between having security tools and actually being secure is bridged by security practices — the organizational processes, methodologies, governance frameworks, and human…

Security technology alone cannot protect an organization.

Encryption protects data at rest but not the application that decrypts it.

The gap between having security tools and actually being secure is bridged by security practices — the organizational processes, methodologies, governance frameworks, and human…

Together, these practices constitute information security management — the discipline that transforms technical security into organizational security.

Risk management is the systematic process of identifying, assessing, and treating risks to organizational assets.

It is not about eliminating all risk — that is impossible.

It is about making informed decisions about which risks to accept, which to mitigate, and how much to invest in doing so.

NIST SP 800-30 ( Guide for Conducting Risk Assessments ) is the foundational U.S.

You cannot protect what you do not know you have.

Asset inventory is the starting point of risk management.

An information asset is anything of value to the organization that processes, stores, or transmits information: servers, databases, applications, endpoint devices, network…

Assets are characterized by their value — both quantitative (replacement cost, revenue generated, regulatory penalty exposure) and qualitative (reputational value, operational…

A threat is a potential cause of an unwanted incident that could result in harm to the organization.

Threats are characterized by their source (who or what is behind them) and event (what they might do).

Threat intelligence can be consumed from commercial providers (CrowdStrike, Mandiant), government sources (CISA advisories, FBI flash alerts), industry sharing groups (ISACs —…

Intelligence is operationalized into security controls: blocking known-malicious IPs, updating detection signatures, patching actively exploited vulnerabilities.

After identifying and assessing risks, organizations choose how to treat them: - Mitigate (Reduce) : Implement controls to reduce the likelihood or impact of the risk.

Patching vulnerabilities, adding MFA, encrypting data, and deploying firewalls are all mitigation measures.

- Transfer : Shift the financial consequences of the risk to a third party, typically through cyber insurance.

Transfer does not eliminate the operational impact of a breach — it addresses the financial liability.

Effective risk management requires measurement.

Security Metrics and KPIs connects to risk, controls, and evidence.

Security Metrics and KPIs connects to risk, controls, and evidence.

Understanding the weaknesses in your own systems before attackers find them is a cornerstone of proactive security.

Two complementary approaches serve this purpose:

Vulnerability Assessment and Penetration Testing connects to risk, controls, and evidence.

A vulnerability assessment is a systematic examination of systems to identify known vulnerabilities — unpatched software, misconfigured services, default credentials, missing…

It is primarily a discovery exercise: here is what is wrong, here is the severity, here is how to fix it.

Vulnerability assessments are typically performed using automated scanning tools: Nessus, Qualys, OpenVAS, Rapid7 InsightVM.

They should be run regularly (weekly or monthly for critical systems) and after significant infrastructure changes.

A penetration test (pentest) goes beyond vulnerability scanning: it involves skilled security professionals attempting to exploit identified vulnerabilities to demonstrate…

A pentest answers the question: "If an attacker exploited these vulnerabilities, how far could they get, and what could they access?" The penetration testing lifecycle follows a…

Planning and Reconnaissance : Agree on scope, rules of engagement, and objectives.

Scanning and Enumeration : Use tools (Nmap, Masscan, Nikto, Burp Suite, OWASP ZAP) to identify open ports, services, operating system versions, web application frameworks, and…

Security is not only about preventing breaches — it is also about ensuring that business operations can continue through disruptions, whether from cyberattacks, natural disasters,…

Business Continuity Planning (BCP) addresses how the organization maintains critical business functions during and after a disruptive event.

It is broader than IT recovery: it includes people (who does what if key staff are unavailable), processes (how are critical functions performed manually if systems are down), and…

Disaster Recovery (DR) focuses specifically on restoring IT systems and data after a catastrophic failure.

Defenses include maintaining offline or immutable backups (cloud object storage with Object Lock, air-gapped tape backups) that ransomware cannot reach or encrypt.

Backups must be tested regularly — an untested backup is not a backup.

DR strategies range in cost and recovery speed: - Cold site : Backup facility with infrastructure but no running systems; recovery takes days.

- Warm site : Standby environment with systems partially configured; recovery takes hours.

Despite best efforts, security incidents will occur.

The ability to detect incidents quickly and respond effectively limits their impact — every minute of undetected intrusion is time for the attacker to steal more data, spread…

NIST SP 800-61 ( Computer Security Incident Handling Guide ) defines the incident response lifecycle as six phases:

Preparation occurs before any incident.

Preparation connects to risk, controls, and evidence.

Preparation connects to risk, controls, and evidence.

The detection phase involves identifying indicators of compromise (IOCs) or unusual activity that suggests an incident has occurred.

Sources include SIEM alerts, EDR detections, user reports, threat intelligence feeds, and external notifications (e.g., from CISA, a partner organization, or a security…

Analysis involves determining: What happened?

Is it a true positive or false positive?

Containment limits the spread and impact of the incident.

Short-term containment may involve isolating affected systems (removing network access), blocking malicious IPs or domains, disabling compromised accounts, and preserving evidence.

Long-term containment involves implementing temporary fixes to allow business continuity while full eradication is prepared.

Warning — Evidence Preservation : Containment actions must be balanced against evidence preservation.

Eradication removes the cause of the incident: deleting malware, closing exploited vulnerabilities, removing backdoors and persistence mechanisms (scheduled tasks, startup…

Eradication connects to risk, controls, and evidence.

Eradication connects to risk, controls, and evidence.

Recovery restores affected systems to normal operation.

This involves restoring from known-clean backups, reimaging compromised systems (often preferable to trying to "clean" them in place), applying patches, and gradually restoring…

Recovery connects to risk, controls, and evidence.

After recovery, the IR team conducts a thorough review: What happened?

What could have been done faster or better?

What controls would have prevented or limited the incident?

Lessons learned should result in concrete improvements to security controls, detection capabilities, and IR procedures.

Digital forensics is the science of collecting, preserving, analyzing, and presenting digital evidence in a manner that maintains its integrity and legal admissibility.

Chain of Custody : Every piece of evidence must have a documented chain of custody — a record of who collected it, when, where, how it was stored, who accessed it, and how it was…

Breaks in chain of custody can render evidence inadmissible in legal proceedings.

Forensic Imaging : Forensic analysis is conducted on a bit-for-bit copy of the original evidence (forensic image), not on the original itself.

Security audits systematically evaluate whether security controls are in place, properly configured, and effective.

Internal audits are conducted by organizational staff; external audits by independent third parties.

Types include: - Compliance audits : Verify adherence to specific regulatory requirements (HIPAA, PCI-DSS).

- Technical security assessments : Assess the technical security posture of systems (vulnerability scans, configuration reviews, penetration tests).

Introduction

Information Security Risk Management

Asset Identification and Valuation

Threat Identification and Threat Intelligence

Where Introduction applies.

Where Information Security Risk Management applies.

How the difference changes the security decision.

Identify the asset or process at risk.

Choose a preventive, detective, or corrective control.

Explain what evidence would prove the control is working.

Define one core concept in plain language.

Compare two controls or threats from the week.

Apply one idea to a campus or business system.

Evaluate why a solution might fail in practice.

Collect evidence, not just screenshots.

Explain what the artifact proves.

Connect the proof back to risk and control selection.

Security Practices, Risk Management, and Compliance

Security is a decision process, not just a tool list.

Use the reading to justify practical choices.