ISC2 SSCP Course Notes

Professional operational security: ethics, foundational security properties, control categories/functions, asset/change lifecycle, awareness, and physical security.

• Confusing control category (technical/physical/admin) with control function (prevent/detect/etc.).

• Ethics: public safety/trust comes before convenience.

Identity and access: MFA/SSO/federation, device identity, trust boundaries, identity lifecycle, access-control models, and privileged access.

• Calling OAuth 2.0 an authentication protocol by itself.

• Count MFA factor categories, not prompts.

Risk and monitoring: risk visibility/treatment, legal/privacy constraints, assessment and vulnerability lifecycle, SIEM/log operations, and analysis/escalation.

• Using CVSS as the entire risk decision.

• Business context beats raw vulnerability severity.

Incident response, forensics, and resilience: sequence response correctly, preserve evidence, and restore critical business/IT services to defined recovery objectives.

• Eradicating before containing a spreading threat.

• NEXT-action questions: identify the current phase first.

Cryptography: select the right property and mechanism, use secure protocols, and protect keys/certificates through their full lifecycle.

• Using hashing for confidentiality.

• Property first, primitive second.

Network security: layers and ports, attack patterns, NAC/AAA, segmentation and device placement, security appliances, wireless, and IoT.

• Assuming a VLAN alone is a complete security boundary.

• Layer first, then control.

Systems security: malicious code/activity, endpoint controls, mobile/BYOD, cloud shared responsibility, and virtualized/containerized environments.

• Relying only on signature AV against fileless behavior.

• Identify malicious behavior before selecting controls.