CISMP (Certificate in Information Security Management Principles) Procedural and People Security Controls Syllabus

Give examples of delivery methods for security awareness.

E-learning modules, posters and intranet articles, newsletters, simulated phishing exercises, classroom/inductions, lunch-and-learn sessions, screensavers, and gamification.

How can the effectiveness of an awareness programme be measured?

Metrics such as simulated phishing click rates, incident report numbers, quiz/test scores, policy acknowledgement rates, completion rates, and trend analysis over time.

Why must awareness be a continuous programme rather than a one-off event?

Threats evolve, staff forget, and new joiners arrive; reinforcement and refreshes sustain behaviour change, whereas a single session quickly loses impact.

Define social engineering.

The manipulation of people into performing actions or divulging confidential information by exploiting human psychology and trust, rather than attacking technology directly.

Name common psychological principles social engineers exploit.

Authority, urgency/scarcity, reciprocity, social proof, liking/familiarity, fear, and helpfulness - leveraging these to override normal scepticism.

Differentiate phishing, spear phishing, and whaling.

Phishing is mass, untargeted fraudulent messaging; spear phishing is targeted at a specific individual/group using personalised detail; whaling targets senior executives ('big fish').

What social-engineering techniques are 'vishing' and 'smishing'?

Vishing is voice phishing carried out over the telephone; smishing is phishing conducted via SMS/text messages.

Define 'pretexting' and 'tailgating' as social-engineering techniques.

Pretexting is inventing a fabricated scenario/identity to extract information or access; tailgating (piggybacking) is following an authorised person through a physical access point without authenticating.

What is 'baiting' in social engineering?

Luring a victim with something enticing (e.g. a USB drive labelled 'payroll' left in a car park, or a free download) that delivers malware or harvests credentials when used.

List key organisational defences against social engineering.

Staff awareness/training, clear verification procedures for requests, reporting channels, simulated phishing tests, least-privilege access, and policies forbidding sharing of credentials.

What is the single most effective defence against social engineering, and why?

A well-informed, sceptical workforce - because social engineering targets people, trained staff who verify requests and report suspicious activity directly neutralise the attack vector.

Define identification, authentication, and authorisation, in that order.

Identification: claiming an identity (e.g. a username). Authentication: proving that claimed identity is genuine. Authorisation: granting the authenticated identity the specific rights/permissions to access resources.

What are the three classic categories of authentication factors?

Something you know (knowledge, e.g. password/PIN), something you have (possession, e.g. token/smartcard), and something you are (inherence, e.g. biometric).

What additional authentication factor categories are sometimes added to the classic three?

Somewhere you are (location, e.g. geolocation/IP) and something you do (behavioural, e.g. typing rhythm or gait).

Define multi-factor authentication (MFA) and why it is stronger than single-factor.

MFA requires two or more factors from different categories. It is stronger because an attacker must compromise multiple independent factors, so stealing just a password is insufficient to gain access.

Why is using two passwords NOT multi-factor authentication?

Both are the same factor category (something you know), so it is two-step single-factor; true MFA combines distinct factor types (e.g. password + token).

In biometrics, define the False Acceptance Rate (FAR) and False Rejection Rate (FRR).

FAR is the rate at which the system wrongly accepts an unauthorised person (a security failure); FRR is the rate at which it wrongly rejects an authorised person (a usability failure).

What is the Crossover Error Rate (CER / Equal Error Rate) in biometrics?

The point at which the False Acceptance Rate equals the False Rejection Rate ($FAR = FRR$); a lower CER indicates a more accurate biometric system.

As a biometric system's sensitivity threshold is raised, how do FAR and FRR change?

FAR decreases (fewer impostors accepted) while FRR increases (more legitimate users rejected); the two trade off against each other, balanced at the CER.

What is single sign-on (SSO) and one of its key risks?

SSO lets a user authenticate once to access multiple systems. Key risk: it creates a single point of failure - if the SSO credential is compromised, all linked systems are exposed (keys-to-the-kingdom).

Define the Discretionary Access Control (DAC) model.

DAC lets the owner of a resource decide who may access it and grant permissions at their discretion (e.g. file owners setting permissions). It is flexible but harder to centrally enforce.

Define the Mandatory Access Control (MAC) model.

MAC enforces access based on system-wide security labels/clearances set by a central authority; users cannot change permissions. Access is decided by comparing subject clearance to object classification (e.g. military systems).

Define Role-Based Access Control (RBAC).

RBAC assigns permissions to roles rather than individuals; users acquire permissions by being assigned to roles. It simplifies administration and supports least privilege in large organisations.

Define Attribute-Based Access Control (ABAC).

ABAC grants access by evaluating policies against attributes of the user, resource, action, and environment (e.g. department, time, location), enabling fine-grained, context-aware decisions.

Compare DAC and MAC on flexibility versus control.

DAC is flexible and user-driven but harder to enforce consistently; MAC is rigid and centrally controlled, offering strong, uniform enforcement at the cost of flexibility.

State the principle of least privilege.

Users (and processes) should be granted only the minimum access rights necessary to perform their legitimate tasks, and no more - limiting the damage from misuse, error, or compromise.

State the principle of separation (segregation) of duties.

Splitting a sensitive task across multiple people so no single individual can complete it alone, reducing the risk of fraud and error (e.g. one person requests, another approves).

What is the 'need to know' principle?

Access to specific information is granted only to those who require it to perform their duties, even if they hold the necessary clearance level - limiting exposure of sensitive data.

Why are shared/generic accounts discouraged in privilege management?

They break accountability - actions cannot be traced to an individual - and complicate revocation, weaken audit trails, and increase the risk of credential misuse.

What controls should govern privileged (administrator) accounts?

Restrict to named individuals, apply least privilege, use separate accounts for admin vs normal tasks, enforce MFA, log and monitor all activity, and review/recertify access regularly.

What is the purpose of periodic access reviews (recertification)?

To regularly verify that each user's access rights are still appropriate, detecting and removing access creep, orphaned accounts, and excessive privileges to maintain least privilege over time.