ISC2 CC Course Notes

Master the fundamentals: CIA, AAA, non-repudiation, privacy, risk lifecycle, governance hierarchy, control categories, and professional ethics.

• Confusing authentication and authorization.

• Identify the security objective before selecting a control.

Security Governance is GRC, continuity/redundancy, security culture, and measuring whether the program actually works.

• Treating compliance paperwork as the purpose of GRC.

• GRC is traceability and accountability.

IAM is lifecycle plus authorization: define roles, provision, review, deprovision, apply least privilege, separate duties, and know access-control models.

• Adding new-role access without removing old access.

• JML = Joiner/Mover/Leaver.

Networking and cloud now includes network fundamentals, architecture/Zero Trust, wireless and IoT/ICS, plus cloud characteristics, models, and shared responsibility.

• Treating a VPN as endpoint security.

• Layer first, control second.

Security Operations and Incident Response now covers data security, logging/triage/threat intelligence, IR planning/exercises, asset/change lifecycle, and modern security testing.

• Calling masking encryption.

• Correlate -> triage -> prioritize -> escalate.