CISMP (Certificate in Information Security Management Principles) Technical Security Controls Syllabus

Distinguish an IDS from an IPS.

An Intrusion Detection System (IDS) passively monitors and alerts on suspicious activity (out-of-band, detect-only). An Intrusion Prevention System (IPS) sits inline and can actively block or drop malicious traffic in real time.

Compare a NIDS and a HIDS.

A Network IDS (NIDS) monitors traffic across a network segment from a sensor point. A Host IDS (HIDS) runs on an individual host monitoring its files, logs, and activity. NIDS gives breadth; HIDS gives host-level depth.

Contrast signature-based and anomaly-based intrusion detection.

Signature-based detection matches activity against known attack patterns (low false positives, misses novel attacks). Anomaly-based detection builds a baseline of 'normal' and flags deviations (can detect novel attacks but produces more false positives).

In intrusion detection, define a false positive and a false negative.

A false positive is a legitimate/benign event incorrectly flagged as malicious (a false alarm). A false negative is a genuine attack that the system fails to detect (a missed detection) - the more dangerous of the two.

What is a honeypot and what is its purpose?

A decoy system or resource deliberately exposed to attract and detect attackers, divert them from real assets, and gather intelligence on attack techniques. A honeynet is a network of honeypots.

What is a VPN and what core security services does it provide for remote access?

A Virtual Private Network creates an encrypted tunnel over an untrusted network (e.g. Internet), providing confidentiality (encryption), integrity, and authentication so remote users can securely access internal resources.

Compare IPsec and SSL/TLS VPNs.

IPsec VPNs operate at the network layer, typically need a client, and secure all IP traffic (good for site-to-site/full network access). SSL/TLS VPNs operate at the transport/application layer, are often clientless via a browser, and suit per-application remote access.

What is multi-factor authentication (MFA) and why is it important for remote access?

MFA requires two or more independent factors from: something you know (password), something you have (token/phone), something you are (biometric). It mitigates the risk of stolen/guessed passwords being sufficient to gain remote access.

Why is remote access a heightened security concern, and name two controls that address it.

It extends the trust boundary beyond physical/organisational control onto unmanaged networks and devices. Controls: strong MFA, VPN encryption, endpoint posture checking/NAC, least privilege, and session logging (any two).

What is Network Access Control (NAC)?

A technology that enforces security policy on devices attempting to connect to a network, checking identity and device posture (patch level, AV status) before granting access and quarantining non-compliant devices.

Identify two key security concerns for IoT devices.

Weak/default credentials, infrequent or absent patching, limited compute for security controls, insecure communications, and a large attack surface - leading to easy compromise and use in botnets (any two).

What is the 'shared responsibility model' in cloud security?

A model defining the split of security duties between cloud provider and customer: the provider secures the underlying cloud infrastructure ('security of the cloud'), while the customer secures their data, identities, and configurations ('security in the cloud').

What does the CIA triad stand for and how does cryptography support it?

Confidentiality, Integrity, Availability. Cryptography supports confidentiality via encryption, integrity via hashing/MACs, and authentication/non-repudiation via digital signatures (it does not directly provide availability).

Distinguish symmetric from asymmetric encryption.

Symmetric encryption uses a single shared secret key for both encryption and decryption (fast, but key distribution is hard). Asymmetric encryption uses a mathematically related public/private key pair (slower, but solves key distribution).

Give two examples each of symmetric and asymmetric algorithms.

Symmetric: AES, 3DES, ChaCha20, RC4. Asymmetric: RSA, ECC (Elliptic Curve), Diffie-Hellman, DSA (any two of each).

In asymmetric cryptography, which key encrypts and which decrypts for confidentiality?

To send confidential data, the sender encrypts with the recipient's public key; only the recipient's matching private key can decrypt it, so only the intended recipient can read it.

What is a cryptographic hash function and what three properties must it have?

A one-way function mapping data to a fixed-length digest. Properties: deterministic/one-way (infeasible to reverse), collision resistance (hard to find two inputs with the same hash), and the avalanche effect (small input change drastically changes output).

Why is encryption different from hashing?

Encryption is a reversible (two-way) process using keys to provide confidentiality. Hashing is a one-way, irreversible process producing a fixed-length digest used for integrity verification, not for recovering the original data.

What is the difference between a hash and a salt, and why salt passwords?

A hash is the digest of the input; a salt is a unique random value added to each password before hashing. Salting ensures identical passwords produce different hashes, defeating precomputed rainbow-table attacks.

What is the Kerckhoffs's principle of cryptography?

A cryptosystem should remain secure even if everything about the system, except the secret key, is public knowledge. Security must rest on the secrecy of the key, not the obscurity of the algorithm.

Define key management and list typical stages of the key lifecycle.

Key management is the secure handling of cryptographic keys throughout their lifetime. Stages: generation, distribution/exchange, storage, use, rotation, archival/escrow, and destruction (revocation).

Why is secure key distribution the central challenge of symmetric cryptography?

Because both parties must share the same secret key in advance; transmitting it over an insecure channel risks interception, and with many parties the number of keys grows rapidly. Asymmetric key exchange (e.g. Diffie-Hellman) helps solve this.

What is the formula for the number of symmetric keys needed for n parties to communicate pairwise?

$$\frac{n(n-1)}{2}$$ For example, 10 parties require $\frac{10 \times 9}{2} = 45$ keys, illustrating the scalability problem of symmetric key management.

What is a Hardware Security Module (HSM)?

A tamper-resistant physical device that securely generates, stores, and manages cryptographic keys and performs crypto operations, keeping keys protected and preventing their extraction in plaintext.

What is key escrow?

A scheme in which copies of cryptographic keys are securely held by a trusted third party so that data can be recovered under defined conditions (e.g. lawful access, key loss, or employee departure).

What is a Public Key Infrastructure (PKI)?

The framework of policies, roles, hardware, software, and procedures (CAs, RAs, certificates, CRLs) used to create, manage, distribute, store, and revoke digital certificates and bind public keys to verified identities.

What role does a Certificate Authority (CA) play, and how does an RA differ?

A CA is a trusted entity that issues and digitally signs digital certificates vouching for the binding of a public key to an identity. A Registration Authority (RA) verifies the requester's identity and approves requests but does not issue the certificate itself.

What is contained in an X.509 digital certificate?

The subject's identity, the subject's public key, the issuing CA's name, validity period (not-before/not-after dates), serial number, certificate usage, and the CA's digital signature.

How is a digital signature created and verified?

Creation: the sender hashes the message and encrypts the hash with their private key. Verification: the recipient decrypts the signature with the sender's public key and compares it to a freshly computed hash of the received message; a match confirms integrity and authenticity.

Which three security services does a digital signature provide?

Integrity (message unaltered), authentication (proof of sender identity), and non-repudiation (sender cannot later deny signing). It does not by itself provide confidentiality.

What are a CRL and OCSP used for in PKI?

Both check certificate revocation. A Certificate Revocation List (CRL) is a periodically published list of revoked certificate serial numbers. OCSP (Online Certificate Status Protocol) provides real-time, on-demand status checks for a single certificate.

What is the difference between data 'at rest', 'in transit', and 'in use', with an example control for each?

At rest: stored data - full-disk/file encryption. In transit: data moving over networks - TLS/IPsec. In use: data being processed in memory - secure enclaves/memory protection and access controls.

How does TLS protect web traffic (HTTPS)?

TLS uses asymmetric cryptography and certificates to authenticate the server and securely exchange a session key, then uses fast symmetric encryption for the session, providing confidentiality and integrity of data in transit.

What is a digital certificate's role in achieving non-repudiation for an email (e.g. S/MIME)?

By signing the email with the sender's private key (whose corresponding certificate binds it to their verified identity), the sender cannot credibly deny authorship, and recipients can verify integrity and origin.

What is secure (hardened) system configuration?

Configuring systems to a secure baseline by removing or disabling unnecessary services, ports, accounts, and software; changing default credentials; applying least privilege; and enabling security settings to reduce the attack surface.

Why are default credentials and unnecessary services a security risk?

Default credentials are publicly known and easily exploited; unnecessary services/ports increase the attack surface and may contain vulnerabilities. Both should be removed/changed as part of system hardening.

What is a configuration baseline / security benchmark (e.g. CIS Benchmarks)?

A documented, standardised set of secure configuration settings that systems are built to and measured against, providing a consistent, auditable hardened state and a reference for detecting unauthorised drift.

What is 'security by design' in software development?

Building security into software from the earliest design stages and throughout the lifecycle (requirements, design, coding, testing) rather than adding it as an afterthought, reducing vulnerabilities and remediation cost.

What is a Secure Software Development Lifecycle (SSDLC / SDL)?

An SDLC that integrates security activities at every phase: security requirements, threat modelling, secure design, secure coding standards, security testing (SAST/DAST), code review, and secure deployment/maintenance.

Why is input validation a critical secure-coding control?

Untrusted input is the root of many attacks (SQL injection, XSS, buffer overflow). Validating, sanitising, and encoding input ensures data conforms to expected format and cannot be interpreted as code or commands.

Compare SAST and DAST in software security testing.

SAST (Static Application Security Testing) analyses source code/binaries without executing it ('white-box', early in lifecycle). DAST (Dynamic Application Security Testing) tests the running application from the outside ('black-box', finds runtime/config flaws).

Why should development, testing, and production environments be separated?

To prevent untested or insecure code, test data, and developer access from affecting live systems, to protect production data, and to enforce controlled, authorised promotion of changes between environments.

What is change management and why is it a security control?

A formal process for requesting, assessing, approving, testing, implementing, and reviewing changes to systems. It reduces the risk that unauthorised or poorly tested changes introduce vulnerabilities, instability, or outages.

List the typical stages of a formal change management process.

Request/raise change (RFC), assess/impact and risk analysis, authorise/approve (e.g. CAB), schedule, test, implement, review/verify, and close - with a defined rollback (back-out) plan.

What is configuration management and what is a CMDB?

Configuration management is the process of identifying, controlling, and tracking the state of all configuration items (CIs) and their relationships. A CMDB (Configuration Management Database) is the repository recording these CIs and their attributes.

What is the purpose of having a documented back-out (rollback) plan in change management?

To enable a system to be restored to its previous known-good state if a change fails or causes unexpected problems, minimising downtime and impact during a failed change.

Why is emergency change management still subject to controls?

Even urgent fixes must be tracked, risk-assessed, and retrospectively authorised and documented to maintain accountability, avoid introducing new risks, and preserve an accurate configuration record and audit trail.

What is the security purpose of logging and monitoring?

To record system, network, and user events so that security incidents can be detected, investigated, and responded to; to support accountability and forensic analysis; and to demonstrate compliance.

What is a SIEM and what does it do?

Security Information and Event Management is a system that aggregates, normalises, and correlates logs and events from across an estate in real time to detect threats, generate alerts, support investigation, and aid compliance reporting.

Why must audit logs themselves be protected, and how?

Attackers alter or delete logs to hide activity, so logs must be protected for integrity and availability via centralised/remote collection, write-once or append-only storage, access controls, hashing/signing, and tamper detection.

Why is accurate time synchronisation (e.g. NTP) important for logging?

Correlating events across multiple systems during investigations requires consistent timestamps; synchronised clocks (via NTP) ensure log entries can be reliably ordered and matched to reconstruct an incident timeline.

What is the difference between active and passive monitoring?

Active monitoring proactively probes/tests systems (e.g. sending requests, synthetic transactions, vulnerability scans). Passive monitoring observes existing traffic and logs without injecting activity (e.g. a NIDS or log analysis).

Why should log retention periods be defined, balancing two competing concerns?

Logs must be kept long enough to support incident investigation and meet legal/regulatory obligations, but not so long as to create excessive storage cost and conflict with data protection/minimisation requirements - so a defined retention policy is needed.